Re: Power Management GPO?

Ok, trying to bring this thread to some closure... Here's what I'm doing
now, a multi-front effort.

I'm modifying the security settings on all my computers as suggested in the
blog linked below. This gives all the users on a computer the rights to
modify their own power settings.

I created a group policy with the ADM template suggested by Florian that
sets the power scheme to 'Always On'. This sets the standby delay to never
so the computer never goes into standby. This policy also has a computer
startup script that creates a power.cmd script and creates a task that runs
power.cmd during login.

The power.cmd file uses powercfg to turn off the hibernation and require
password on resume from standby features.

The only thing I need to make this really slick is a script that will mod
registry for me and some way to change the "When I press the power button on
my computer:" option of the power settings. By default it is set to
Standby, I much prefer it turn off the computer.

Whew, what a pain. I sure hope Vista handles this better.

Thanks for all the help Jeremy and Florian and all. If anyone has any other
suggestions please let me know.

Thanks,
Linn

"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:uDz3YKIqHHA.2288@xxxxxxxxxxxxxxxxxxxxxxx
I just found this, this afternoon and it looks promising.

http://blogs.msdn.com/aaron_margosis/archive/2005/02/09/370263.aspx#440777

I made the registry changes as the author suggests and I was able to make
changes to the power scheme as a standard user. I need to do some further
testing yet but I'm kind of out of time, traveling the remainder of the
week. Just thought I'd pass it along.

Linn

"Jeremy" <jeremy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:241A02A5-E247-4E75-91F7-8F7C878608E4@xxxxxxxxxxxxxxxx
Therein lies the problem. The settings ARE stored in the users
nduser.dat file and I have managed to isolate them in the past and merge
the desired settings into the default user profile. Unfortunately
something that happen during profile creation overwrites them. It's like
the power settings are created on the fly and overwrite any settings in
the default user profile.

If you configure a reference profile and then copy that over the top of
the default user profile this DOES work (from memory, I'm 90% sure). See
this article on doing that: http://support.microsoft.com/kb/319974

I've always tried to avoid this though. If you have a look through the
profile that gets created from a default user profile generated in this
way still has HEAPS of artefacts from the user used to generate it.


"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:%23h9RFr3pHHA.4496@xxxxxxxxxxxxxxxxxxxxxxx
Jeremy,

I'm guessing you are right and that the creation of the power scheme is
a user setting and not in scope or whatever when running as System.
That would explain it.

CMDLINES.TXT isn't an option that I can see since all my systems are
deployed. I need to implement this in a production environment and we
buy our computers with the OS preinstalled.

I tried changine the extension to .cmd but that didn't make any
difference that I could tell.

When I create the scheme as admin I can see the scheme when logged in as
a user. If you look back in this thread there is an ADM template that
Florian Frommherz provided that sets the active power scheme. I haven't
figured out exactly how to set that to pick a different power scheme
yet.

The other problem I see is that setting the password required on resume
feature is user dependant and you have to have rights to do it. So when
I run the command, "powercfg /g off /option:resumepassword", as a user I
get an access denied message.

It occurse to me though, that all of these settings must be picked up by
the user from the default user profile when the user's profile is
created. Isn't there some way to modify the default user profile? Of
course, this doesn't solve the problem for existing users. I wonder
where in the registry these settings are stored, couldn't the registry
be modified in the GPO for each user?

Thanks,
Linn

"Jeremy" <jeremy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:062C8D5C-4919-4434-9F7F-3446F930FC4B@xxxxxxxxxxxxxxxx
My guess is that the two that are working are per-machine settings, but
the power scheme settings are per-user and it doesn't like the system
context I suppose. When I tested I was only using a single line that
turned hiberation off. So I guess if you ran the scheduled task as a
real user then it would work. I told you power management settings
were evil....

When I've done this sort of thing during the past I have always
scripted it during the post setup autologon, or using CMDLINES.TXT in
an unattended setup, so it has been running as the built-in
administrator account. The benefit of running during CMDLINES is also
that it modified the default user profile too.

On the .bat vs .cmd thing, if it is running on Windows XP you are
always better off using .cmd since this shell has much more flexibility
in scripting and everything doesn't always work with .bat. But in your
case I don't think this is a problem, but change it anyway just to be
sure.

When you create the new scheme running as an Admin, is the scheme
subsequently available to normal users?

"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:e7KQC3rpHHA.1244@xxxxxxxxxxxxxxxxxxxxxxx
Ok, further testing. I added a couple lines to the batch file to
create a log file for my batch file. This showes that my batch file
is being processed but my commands aren't taking I guess. Here's my
batch file:

echo Running power.bat >> c:\powerlog.txt
date /t >> c:\powerlog.txt
time /t >> c:\powerlog.txt

powercfg /c cmw
powercfg /s cmw
powercfg /x cmw /monitor-timeout-ac 25 /disk-timeout-ac 0
/standby-timeout-ac 0 /monitor-timeout-dc 10 /disk-timeout-dc 10
/standby-timeout-dc 15
powercfg /h off
powercfg /g off /option:resumepassword

I can see that the last two lines are working, hibernation and
password on returning from standby are getting turned off. But the
creation of my power scheme is not working for some reason when run
from the schedule.

Any thoughts on this?

Thanks,
Linn

"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:eHJa2crpHHA.4212@xxxxxxxxxxxxxxxxxxxxxxx
It's the wierdest thing, when I run the task manually, (right-click,
run now), nothing happens. If I run the batch file manually it works
fine. The task doesn't seem to be working although I can't see any
problem with it's properties. Maybe I should post this in the
scripting group?

Just as a test I created a new task to run the same batch file using
the Scheduled Tasks control panel and that doesn't work either.
Could it be that batch files, files with a *.bat extention, don't
work with scheduled tasts?

Thanks,
Linn

"Jeremy" <jeremy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:EC7AC87A-F890-4B59-BDC8-B2E97C4D3916@xxxxxxxxxxxxxxxx
Well the 0 exit code is just what the batch file is returning,
rather than the powercfg exit code. I'm not sure where to point you
because when I set the batch file to run at system startup it worked
well. What happens when you run the task manually from task
scheduler (right-click, run now)?

"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:OBh%23$LJpHHA.3772@xxxxxxxxxxxxxxxxxxxxxxx
Thanks for the suggestions Jeremy. I followed your advice and
setup a batch file using powercfg to set all the power settings the
way I'd like them to be. Ran the batch file as Administrator and
it worked fine. Next I created a scheduled task to run my batch
file as "system" and to run at system start up. That worked as
well.

So then I created a GPO that runs a computer startup script. The
script checks for the existance of my batch file in the root of the
target PC. If the batch file does not exist it creates it and then
creates a task to run it at startup using the "system" account.

All of this works, however, when the computer starts the batch file
isn't run... well, it looks like it's running but it does not set
the power settings. When I look at the task scheduler log file it
shows the following entries:

"Power Setup.job" (power.bat)
Started 6/1/2007 4:04:15 PM
"Power Setup.job" (power.bat)
Finished 6/1/2007 4:04:16 PM
Result: The task completed with an exit code of (0).
[ ***** Most recent entry is above this line ***** ]

I'm guessing the exit code of (0) is a good exit code as opposed to
an error exit code. I'm not sure what's happening now. Any
suggestions? Or should I post this question on a different news
group?

Thanks much,
Linn

"Jeremy" <jeremy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:41FDEE4D-EE9C-4195-9E9A-9E2CE683AE85@xxxxxxxxxxxxxxxx
I think I have a fix for this. I created a scheduled task that
runs as SYSTEM and executes the .cmd file I created which has the
following line in it:

powercfg /hibernate off

I turned hibernate on, then waited for the schedule and it worked,
so SYSTEM does have the ability to change power settings. So I
changed the schedule to "when the system starts", turned hibernate
on and rebooted and it worked.

So, long story short, I am guessing you could create a startup
script that creates the scheduled task (using schtaks.exe) to run
a second script that sets the power configuration. Then it would
take two reboots, but it would still work. A bit kludgy I
suppose....

Anyhoo, good luck.

Cheers,
Jeremy.

"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:u5UQgpxnHHA.4196@xxxxxxxxxxxxxxxxxxxxxxx
I have been working this afternoon on a script for just this
purpose. I have a power.bat file now that when run by the
administrator sets the power the way I want it. Of course that
only works for the adminstrator.

I created a GPO and put the batch file in first as a startup
script and when that didn't work I tried it as a logon script.
At first it didn't work, then I linked it to the domain
administrator's OU and then it worked for that account. I tried
liking it to the OU of my test user but that didn't work.

Next I added my test user to the administrator's group of the
local computer, now it works. Looks to me like it's a rights
issue at this point. A normal user can't change the power
settings so a logon script like this won't work either. Or am I
missing something here?

Thanks much,
Linn

Ok, now that I've linked my GPO to the administrators and
services
"Jeremy" <jeremy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5D7771AA-D92D-4A3D-9437-344807222726@xxxxxxxxxxxxxxxx
Well using a flag file on the hard disk might be easier then.
This way you can do it with a simple .cmd file.

Run powercfg from the command line with a /? and you will be
able to build the commands you want the set up a .cmd file as
follows:

-->8 snip here
@ECHO OFF
IF NOT EXIST %TEMP%\powerscript.flg (
powercfg command 1
powercfg command 2
powercfg command n
ECHO finished > %TEMP%\powerscript.flg
)
-->8 snip here

The first line turns of local echoing of commands to the screen
to make the output cleaner.
The second line is the test to see if the flag file exists
The next three commands represent you doing your powercfg stuff
The next command writes the flag file so that next time the
script runs, it wont meet the condition so will skip all the
powercfg stuff
The close bracket closes off the IF condition. It is very
important that it be on a line on its own in the script.

I can't remember if all power setting are per machine, but if
some are per machine and some are per user then you could split
it up into 2 scripts, one startup script and one logon script.
The use of the %TEMP% environment variable would mean that if
you ran it as a logon script that the powecfg commands would be
run per user who logged onto the machine.

HTH

Cheers,
Jeremy,



"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:%23T4KAswnHHA.3460@xxxxxxxxxxxxxxxxxxxxxxx
Yes, that's what I'm finding. I have everything setup, I can
see by running gpresult on the client computer that the GPO's
are being applied. They just aren't taking effect.

With EZ-GPO there is a small client executable that needs to be
installed. I can't even get that to work. I can install it
manually but not using a GPO, even though gpresult shows it as
being applied. I don't know what the secret is to that.

I'm not familiar with POWERCFG but I'll look into it. I'm also
not very experienced at writing scripts but I'll take a shot at
it. An example would sure be helpful, especially the bit about
the registry flag.

Thanks much,
Linn

"Jeremy" <jeremy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A3D93BAF-3E24-44DB-B910-BCFBB6B0F1F1@xxxxxxxxxxxxxxxx
Power management settings are evil. Like a few other settings
it appears that the registry is just where they get stored.
From my fiddling it appears that you can change the registry
setting but the GUI setting doesn't change until next startup,
or sometimes even ever. It appears that the power management
API probably retrieves the configured values from here during
system startup then stores them in memory or somewhere else
because now matter how much manual modification I did, I could
never get settings to stick, so here is my suggestion:

Use POWERCFG. If you simply want to set the settings once,
write a script that makes the changes and the drops in a
registry flag to indicate the state so that it doesn't keep
running all the time. If you want to set the settings for
different times of the day as suggested by another poster,
then put in a scheduled task running as SYSTEM that changes
the settings based on the time of day. Adding the scheduled
task can also be scripted in a startup script using
schtaks.exe.

Good luck.
Cheers,
Jeremy.
"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:ejtsGPLnHHA.4516@xxxxxxxxxxxxxxxxxxxxxxx
Hi All,

I'm trying to figure out how to set the power settings of the
computers in my organization. They are almost all Windows XP
Pros, a couple Windows 2000 Pro but I'm not going to worry
about them right now.

I know that Microsoft set this up so that a standard User
does not have rights to change the power settings and so far
I have not been able to find a way to set them globally.

I have been looking at EZ GPO from Terranovum but it only
gets me part way there. There are a couple settings that it
doesn't address. What do you folks do, how do you handle
this... or don't you?

EZ GPO sets the time outs for the User monitor timeout,
System standby timeout and Hibernation timeout, but what
about the other settings? Hard Disk timeout, Prompt for
password when computer resumes from standby, When I press the
power button on my computer and Hibernate enable/disable?
How can I go about setting those options?

Oh, this is an active domain network with Windows 2003 Server
domain controllers.

Thanks in advance,
Linn
























.