Group policy prevents several configuration settings on my Windows 7 / Vista machines. Since my domain account is a member of the local Administrators group on these boxes, is there still a way to override them locally?
For instance, GP prevents changing the power management option "Turn off the开发者_如何学C display" (even changing it from cmd fails: POWERCFG -X -monitor-timeout-ac 60 => "An unexpected error condition has occurred. Unable to perform operation. You may not have permission to perform this operation.")
Even when logging on with a local account and not the domain account, it's not possible to change the setting anymore ..
While @bnkdev is correct, there are ways around it, of course.
For example, since you have admin rights, you can change the permissions on the specific policy-related Registry keys (e.g. HKLM\SOFTWARE\Policies\Microsoft...) such that the SYSTEM account cannot change them (deny write), but you still can.
Also, it's been a while, but I have used a little program called KillPol.exe (see this blog post for info and possible download), which will allow you to override the GPO settings at least temporarily. (Note, however, I don't know if or how well it works on Vista & Win7, which have very different implementations of the Registry.)
Group Policy always trumps local policy.
精彩评论