Permissions on regkey for local user account per machine

Content Authoring
1

(imported topic written by gumbinator91)

We have a local user account as an auto logon to a desktop for the purpose of running in kiosk mode. The local user account needs to have permissions changed on two registry keys to enable us to set the power settings to Always On to prevent the monitor power save default of 20 minute from activating. The keys are in HKLM and I need to assign this user as a power user, and user a wild card as computer name, as this will not be on our domain (user is local account on the machine). (Using Microsoft subinacl in this job to change power settings.) How do I reference this account for the change? Here is a batch fie, but of course it can’t point to computer name wild card, how do I write this in bigfix?

for example

subinacl /subkeyreg “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies” /grant=?? \user =F

\user is what I believe I can do with bigfix tool, I just don’t know how to get the script correct.

2

(imported comment written by MattBoyd)

Hey gumbinator,

Are you subscribed to the BES Power Management site? If you are, you should have a Power Profile Wizard under the Wizards menu. The wizard should allow you to set the monitor standby time to never.

To answer your question about replacing with the actual name of the computer, you can include some relevance like this:

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies" /grant=?? {computer name}\user =F

You may also be able to substitute \user with just .\user but I don’t think the “.” is universally supported by all command line executables…

3

(imported comment written by BenKus)

Hey gumbinator,

As boyd mentioned, we have already solved this problem in BigFix Power Management solution… You can try to recreate the solution yourself, but it wasn’t particularly easy to get working right due to the weirdness of how power policies work in XP (there are actually several different keys you need to change for this method to work right)…

I would suggest getting our Power Management solution to solve these problems…

Ben

4

(imported comment written by gumbinator91)

Thanks very much for your reply. Yes we do have this setup. However, our machines are re-imaged and new instances deployed. I was looking to apply Microsoft’s workaround as well. I have used the job to sovle some machine issues with this problem, but our environment is constantly in flux with machines being re-imged and new ones added into the mix. This constantly changing environment and the fact that I cannot get the power setting jobs to reapply when to these machines come online. Perhaps that is the avenue I should look at here?

I have this job assigned to all computers but only issued it or applied it to certain groups. These groups are dynamic and the job does not solve my problem I guess because of the constantly changing assets in these groups.

This is why I was looking for an alternate method to use as well.

5

(imported comment written by BenKus)

Hi gumbinator,

Perhaps this method would help:

  • Find a way to identify these computers (whether it is by automatic group or some property that we can use).
  • Apply the power policies to this group of computers, but target them “by All computers” rather than by “specific computers”. This will allow the power policies to new computers that are re-imaged that are part of the group.
  • You can also turn on “Reapply” behavior to make sure the policies stay active even if someone or something else changes the power policies.

Ben

6

(imported comment written by MattBoyd)

Also, remember that power profiles are user-based in Windows XP, so the power profile is only applicable when there is a user logged in. Newly-built machines won’t get the profile until a user logged on so that the action is applied.