none
Hide Display Settings not applied in User GPO

    Question

  • Hello,

    I am trying to hide the display settings via a GPO so folks can't change the resolution. I set the "Disable the Display Control Panel" setting to enable, but users can still go to the Control Panel and change the display settings. Other parts of the GPO are applying, like the Ctrl+Alt+Del settings. The GPO has the loopback function set to replace. From my understanding, that should force all user settings in that GPO on everyone who logs into the computer, whether they are in that OU or not. Some settings apply, just not the Display settings. Is there something else I have to enable to get that working?

    Thanks


    Jason Watkins MCSE, MCSA, MCDBA, CCNA

    Thursday, March 12, 2015 3:24 PM

Answers

  • In loopback processing, user settings linked to your computer OU will be the last to apply -Winning!

    Merge - Processes user settings in GPOs linked to user OUs, then user settings in GPOs linked to computer OUs are processed.

    Replace - Processing of user settings in GPOs linked to user OUs are skipped, only user settings in GPOs linked to computer OUs are processed.

    So, are you sure the user setting in the GPO linked to your computer OU is set Enabled in the Disable the Display Control Panel policy setting and that it has the highest precedence (lower number) in the GPMC?

    And make sure there are no OU Block Inheritance and GPO Enforce settings enabled that may be affecting the expected result of this policy setting; although, I'm not sure if that matters when loopback processing is enabled.


    V/R, Darrick West - Senior Systems Engineer, ConfigMgr: OSD











    Thursday, March 12, 2015 10:31 PM

All replies

  • Hello

    tip: check computer acc permission for gpo

    http://support.microsoft.com/kb/953768


    sorry my english

    Thursday, March 12, 2015 5:05 PM
  • The Authenticated users group has "Read" and "Apply Group Policy" with loopback set to "Replace." Most of the GPO's settings are being applied, except for the one I need the most right now. I even created a registry key to disable the Display Control Panel and it STILL didn't work.

    Jason Watkins MCSE, MCSA, MCDBA, CCNA

    Thursday, March 12, 2015 5:15 PM
  • Hello

    try Merge mode.


    sorry my english

    Thursday, March 12, 2015 5:30 PM
  • Still no luck with Merge set in the GPO. I found a tutorial online, explaining exactly what I did with the registry key. It had a file for download that would inject the discussed keys into the registry. As much as I hate to use third-party registry hacks, I still need to keep users from changing the resolution. The downloaded key worked. I am not sure exactly why since I created the same thing on my own, but nonetheless it worked. I'd really like to know why group policy isn't applying that setting.

    Jason Watkins MCSE, MCSA, MCDBA, CCNA

    Thursday, March 12, 2015 6:31 PM
  • I can't. The registry editor won't let me type '0x' into the field. If I choose hex and enter just 30002, I get a different value all together. If I enter 30002 as a decimal, the hex output is different.

    Jason Watkins MCSE, MCSA, MCDBA, CCNA

    Thursday, March 12, 2015 8:30 PM
  • "GPSvcDebugLevel"=dword:00030002

    sorry my english

    Thursday, March 12, 2015 8:53 PM
  • In loopback processing, user settings linked to your computer OU will be the last to apply -Winning!

    Merge - Processes user settings in GPOs linked to user OUs, then user settings in GPOs linked to computer OUs are processed.

    Replace - Processing of user settings in GPOs linked to user OUs are skipped, only user settings in GPOs linked to computer OUs are processed.

    So, are you sure the user setting in the GPO linked to your computer OU is set Enabled in the Disable the Display Control Panel policy setting and that it has the highest precedence (lower number) in the GPMC?

    And make sure there are no OU Block Inheritance and GPO Enforce settings enabled that may be affecting the expected result of this policy setting; although, I'm not sure if that matters when loopback processing is enabled.


    V/R, Darrick West - Senior Systems Engineer, ConfigMgr: OSD











    Thursday, March 12, 2015 10:31 PM
  • > choose hex and enter just 30002, I get a different value all together.
     
    Yes: 0x30002 = 196610 :)
     
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    Friday, March 13, 2015 8:21 AM
  • Hi Jason,

    It's been a while. How is it going? If it still doesn't work out, we can run command gpresult/h report.html to collect group policy result to check this. Note: to collect computer part group policy settings, we need to run the command with administrative privileges.

    In addition, regarding troubleshooting group policy issues, the following thread can be referred to as reference.

    [Forum FAQ] Common steps to start troubleshooting Group Policy application issues

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/382c97e8-93c8-4022-b8fe-22401037d14c/forum-faq-common-steps-to-start-troubleshooting-group-policy-application-issues?forum=winserverGP

    Best regards,
    Frank Shen


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Friday, March 20, 2015 7:45 AM
    Moderator