开发者

Can I override a group policy setting as a machine admin?

Group policy prevents several configuration settings on my Windows 7 / Vista machines. Since my domain account is a member of the local Administrators group on these boxes, is there still a way to override them locally?

For instance, GP prevents changing the power management option "Turn off the开发者_如何学C display" (even changing it from cmd fails: POWERCFG -X -monitor-timeout-ac 60 => "An unexpected error condition has occurred. Unable to perform operation. You may not have permission to perform this operation.")

Even when logging on with a local account and not the domain account, it's not possible to change the setting anymore ..


While @bnkdev is correct, there are ways around it, of course.

For example, since you have admin rights, you can change the permissions on the specific policy-related Registry keys (e.g. HKLM\SOFTWARE\Policies\Microsoft...) such that the SYSTEM account cannot change them (deny write), but you still can.

Also, it's been a while, but I have used a little program called KillPol.exe (see this blog post for info and possible download), which will allow you to override the GPO settings at least temporarily. (Note, however, I don't know if or how well it works on Vista & Win7, which have very different implementations of the Registry.)


Group Policy always trumps local policy.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜