Aaron Margosis' "Non-Admin" and App-Compat WebLog

Now how about a way to view the calendar in the time/date applet without being an admin?

You got it! See http://blogs.msdn.com/aaron_margosis/archive/2005/02/11/371474.aspx

Thanks for this tip. Have you heard any reason as to why allowing the user to manage the power settings is considered some kind of security risk? I could see it on servers, but i have not been able to imagine any for a laptop.

Robert, I agree that for a single-user system it probably does not represent a significant security issue. However, it is a system-wide setting, and regular users are generally not allowed to change system-wide settings. The permissions that I suggest overriding are inherited from the root of HKLM.

Part of Robert Townley's question mentioned that he could see why power settings could be a security risk on servers. I wonder, but can't quite figure it out.

If a server is in a moderately public place (e.g. a desk next to the desks of all workers in a department) then surely power settings aren't a security risk. If a person presses Ctrl-Alt-Delete, but the option to shut down is greyed out because the person doesn't know an administrative password, then the user has to pull the power cord instead.

If the server is in a protected place but the screen, keyboard, and mouse are publicly accessible, then ... I'm still trying to figure it out. Why would this be the server's screen, keyboard, and mouse? Why wouldn't it be a client PC?

Though I guess the security risk is real on such a client PC. One would not want public users to be able to invoke shutdown by any means even though they're logged in, and would not want to let them access the Start menu etc. Public users should only get to do whatever is permitted by some dedicated program. When Windows 98 blue-screens on a client PC, public users don't even get to reboot it, they only get to report it to administrators.

Norman - think "terminal server".

If you have not read Jen's article on LUA, you should be asking yourself why not?

This article...

Complete list of Aaron Margosis' non-admin / least privilege posts, for easy lookup.

Can anyone tell me if there is a registry tweak to make a laptop hold specific power settings for every user that logs in? I have a unique situation with laptops that can never shutdown. I can set it to do that for me, but as soon as another user logs in, their profile has different power settings. many hundreds of users on these particular laptops. Thanks

james A - yeah, load NTUSER.DAT (from the Default Users profile directory) as a temporary hive under HKEY_USERS. Export your power settings from HKEY_CURRENT_USER\Control Panel\PowerCfg and then import them* to this temporary hive under HKEY_USERS. It won't help for existing accounts but all newly created accounts will inherit your power settings.


* Before you can import the .REG file you'll need to edit it to change the regkeys to the name of the temporary mounted hive.

Gary M. I don't understand how to add "load NTUSER.DAT (from the Default Users profile directory) as a temporary hive under HKEY_USERS" I'm a little new to this, can you help me out.

Get your friends and family, all those folks that come to you for computer help once their machines have...

This is one request my users wanted. Thanks for taking the time to figure it out. Since I cannot find a Group Policy setting to control the Power Options, I'll have to resort to changing each machine. Even with Remote Registry Connection it's tedious. At least there is a way to satisfy the users.

Thanks, Bill

Instead of going to each local registry, can changing security permissions be scripted? Thanks, BillR

What would these 'additional steps' be for Win2K? And if you have anything for Win 98 (yes yes, i know, shame on me, but I work for a school) then that info would be all the more appreciated.

It would be nice to have this as a "run once" script, to be used when setting up a (stand-alone / no domain network) computer after install. Could this be done from a script?
/Klaus A

In relation to Windows 2000:

Google for regperm.exe

Download to your PC and from that location run the following command

REGPERM \\COMPUTERNAME /K "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg" /A:Everyone:F /R

Combine this with PSEXEC and a list of PCs and voila! ;-)

What brainiac thought of pressing the power button to get out of standby? The same one that put shutdown under start? What genius decided users couldn't change power settings within their own local profile, then decided that power settings wouldn't be available from an admin template in Active Directory (you need to install a third party client and template). What think tank rolled out SP2 so that when you copy power settings to the default profile and then run sysprep, it reverts them back to the defaults? The calls to the helpdesk over this, people pulling power cords cause their computer wont turn on or off, gawd. boneheaded.

Aaron,

Thank you so much for your registry tip. I have been a long-time W2K user and just switched to XP (Pro) on my home desktop system last month. I was quite disappointed and fustrated that as a limited user, I couldn't change my own power settings. I knew there had to be a registry hack for this and thanks to Google, I found your blog. Many thanks and keep up the great work you're doing. Cheers.

This doesnt work in W2K

I did Google for regperm.exe but it looks like the author of RegPerm.exe has moved his site from the Univ of Wisc. Anyone know where I could get the .exe and a list of the syntax and switches so I could use the login script technique described by Richard Parry above?

I have been able to allow users on our Win2K systems to access power options after manually adjusting reg permissions as described above.

Also, has anyone successfully automated the configuration of the power options themselves for all current users on a particular machine (without using Group Policy)?

Why not just apply the registry permission hack through GPO via Computer Configuration -> Windows Settings -> Security Settings -> Registry?

Aaron,
Thanks a lot for your tip.
Now I have another question, how can I change the power button scheme without entering control panel?

Hi, how would you put this reg script into an adm file?
Cheers

Any idea where in the registry the actual values (time) are for 'Turn off monitor' and 'Turn off hard disks' are? Can't seem to find it.

@Bill Arnete:

I actually found a way. I wrote my very own timedate.cpl replacement which simply runs a specified program. The program is "Rainlendar" with a very delicate Windows Classic skin, which behaves very similar to the original applet.

For version 2.0 of this applet, I grabbed the original source from leaked Win2K source code and I'm fixing it up. For Version 3.0 I planned to add the additional NTP dialog from WinXP + Style support, and of course linking to the correct HelpIDs.

Please (pleasee, please) can you find a way to get this to work for win2k? The regedit option "Right-click on the “GlobalPowerPolicy” key and choose “Permissions”. " just aint there and I can't see an alternative. I've searched high and low for a solution and can't find one.

Seems mad to me that users can't mod their power settings, mbut hey ho.

Jon

This works great. Just one more option: Allow non-admin in XP to enable hibernate. This requires creating the hiberfil.sys file in the root. Any Ideas? I could not find any info on the create pagefile permission.

I´m a system administrator, and have this problem with every new computer we install (more accurately: with every first logon of a user in any computer)
Configuring every computer is a headache for us, so we were looking for a way to solve this problem with a start script.
The problem was that if yougain Administrator access in the script, you can change the power options, but only for the Administrator, not for the current user.
The solution comes in two steps:
First, we need to change the registry permissions, so the user can make changes
Second, set the desired power scheme using the powercfg.exe command line utility

1.Changing registry permissions
You can change the permissions of a registry key using REGINI (Microsoft KB245031). It works well with XP, and you only have to create a file with the keys AND SUBKEYS (very important to include all the subkeys) with the rights for all users.

The command will be something like this
\\server\publicfolder\regini.exe \\server\publicfolder\power.txt

And the file power.txt like this
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg [7 21]
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\GlobalPowerPolicy [7 21]
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies [7 21]
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\0 [7 21]
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\1 [7 21]
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\2 [7 21]
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\3 [7 21]
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\4 [7 21]
\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\5 [7 21]

The problem is that the only one who can change the permissions of HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg is the administrator. So you need to run the REGINI command under the Administrator account, usually with something like CPAU.EXE (http://www.joeware.net/win/free/tools/cpau.htm)

So, the final command will be:
\\server\publicfolder\cpau.exe -u DOMAIN\adminuser -p Password -ex "\\server\publicfolder\regini.exe \\server\publicfolder\power.txt" -lwp

(you can avoid showing the adminuser password using a "job" for CPAU.. read the documentation!!)


2.Setting the desired power scheme
Now it´s easy. You only need to use the powercfg command to select the power scheme you need. The user can change the power scheme because now he has access to the required registry keys.

The command we use is
\\server\publicfolder\powercfg.exe /setactive "always on"

Ok, thats all!!

PD:I beg pardon for my English

For me, Regini.exe did not work, I was pulling my hair out, even using [1 5 7 11 14 17 21] in the txt file. (regini changepowercfgreg.txt) It said it changed the registry permissions, but after logging in as a local user it still failed.

I used SETACL  http://setacl.sourceforge.net
to do this.  


In the batch file, we did:

setacl.exe -on "\\%computername%\HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Controls Folder\PowerCfg\GlobalPowerPolicy" -ot reg -actn ace -ace "n:%computername%\users;p:full"
setacl.exe -on "\\%computername%\HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies" -ot reg -actn ace -ace "n:%computername%\users;p:full"
setacl.exe -on "\\%computername%\HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Controls Folder\PowerCfg" -ot reg -actn ace -ace "n:%computername%\users;p:full"

Then we ran Powercfg with the switches we wanted to configure the Current user settings.  Just in case anyone else had this issue.

OK, taking this one step further, can anybody tell me how to allow a user to CHOOSE and existing power management scheme WITHOUT BEING ABLE to change the scheme settings?

HELP PLEASE.... I tried this hack on my XP Media Center Edition and seemed to have broken something.  The non-admin account has developed this problem where the screen suddenly goes very dim.  I've reversed the registry changes and no luck.  To make matters worst, I forgot the golden rule and forgot to backup the registry before the changes.  The dim screen follows when I log off from the user account to the login screen, but clears when I login to the admin account.  

Has anyone made this work on the XP MCE?  Any ideas on what could have gone wrong?  

thanks for this article,here have a cookie *smiles* i will try this registry hack since power scheme has been buggin me for a while.

I have put together an installer created with NSIS that allows a Limited User Account to change the Power Options. It is based on the comments above by Murmansk and Darth Scream.

The NSIS script can be found here:
http://nsis.sourceforge.net/Use_setacl_to_change_Power_Options

An installer created based on script can be downloaded here:
http://www.duncarin.com/wp2/

PingBack from http://www.duncarin.com/wp2/?p=5

I tried this article, and I get "UNABLE TO CHANGE PERMISSIONS ON GLOBAL POLICY ACCESS DENIED"

Can you help?

I wanted to provide a little more information. I am a regular user logged onto a domain, and I tried the above suggestions and got the response noted above. Here is a screen capture.

http://i4.tinypic.com/102mk2b.jpg

Any help would be appreciated. I run ITUNES and when the computer I use goes into standby, other users that I am sharing music with cannot use my shared music.

Oh I thought the whole point of this article was that you could do this without being an administrator??

Check out this site.  Somebody wrote a template for a custom addin for a GPO to manage power options, along with a small client piece.  Worth the download...
http://www.terranovum.com/projects/energystar/ez_gpo.html

The following works for me:

regperm.exe /K "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\GlobalPowerPolicy" /A:INTERACTIVE:QWCE /E /R /I
regperm.exe /K "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies" /A:INTERACTIVE:QWCE /E /R /I

Another simple fix for non-GPO might be to do a VBScript for both XP & 2000 that you place ro run for all users and place a delete script at the end of the command, the Power Scheme "Always On" is set on both XP & 2000 by default to just power down the monitor, no HD power down, stand-by, etc.

Do a oShell.RegWrite "HKCU\Control Panel\PowerCFG\CurrentPowerPolicy", "3" in the VBScript.  PowerPolicy 3 is "Always On"

BTW - the EZ_GPO tool is excellent and I would def recommend in areas using AD

Thanks this is great

PingBack from http://aszurom.dyndns.org/index.php/2006/08/18/im-tryin-to-not-be-a-hata/

I created a master PC and it had turn drives off at 1 hour.  It was not changed and this was used to Clone to 17 other new indentical PC's.

The issue is we have sessions to an AS400 session and the 1 hour limit on the hard drive plays havoc on the sessions.  

What is my way to get around this?  

I changed Administrator to ALWAYS ON and when a new domain user gets created on the new desktop PC it still show 1 hour time limit for the hard drive to shut down.


This is NUTS

That's the point of this post! When you change the Power Settings while logged-in and Administrator you are changing the settings for just Administrator, not "the machine".

The real problem comes when a user administrator priviledges logs in. He does not have the permission to change the Power Settings. Hence the above work-arounds.

HTH,
Charles

> If you want to allow another specific user or group that ability instead, replace “INTERACTIVE” below with the user or group you want.

INTERACTIVE works for me, but I haven't had success substituting the name of a defined-by-me user group.  I still get a no-access error when I try to apply new power management settings.  Has anyone been able to do this?

Thanks All for your help !!!!!!!

We are in a rather large enviornment that allows some of the users to have access to the power settings and others not to.
The users who are not allowed to change the power settings are in a group that has most everything locked down.

We have tried the interactive solution, which worked for a little while, then a Domain update happened and knocked out interactive.

I have also tried implementing that group having full permissions to the power settings but it is still not working.

My options are somewhat limited. I am part of the help desk, but I am not the Windows Administrator.

I need a way to set it up without any external programs (those would have to go through all the red tape to get approved)so that either the users could change the settings themselves, or set it through group policy or something to have the computer "Always On" One thing that I have found in the past through experimentation is to delete the registry keys  1-6 under the power policies (this kept the computer up 24/7 with no problems, but TechTeam said we should never delete ANY registry keys.)

Can anyone help?

James A said "Can anyone tell me if there is a registry tweak to make a laptop hold specific power settings for every user that logs in? I have a unique situation with laptops that can never shutdown. I can set it to do that for me, but as soon as another user logs in, their profile has different power settings. many hundreds of users on these particular laptops. Thanks"

I would like to know what about existing user accounts?  gary m gave a way to fix this for new accounts.  Which is great!

However, I have a bunch of computers that have multiple user profiles.  I don't need to give them rights to change the power settings, but I want a way to login as Admin, change the power settings, and have this setting take effect no matter who is logged in.  In other words the admin account changes the power settings for the computer, not just the admin account.  Can this be done?  Thanks in advanced.

I wanted to change the power settings without giving everyone the right to change them. I think to do this you must copy the power settings you want to the registry for the Default User (HKEY_USERS\.DEFAULT).

Script to display the current user's power scheme and available power schemes and allow an unprivileged user to chose between (but not modify) them.

'VB script to allow Win2K and WinXP users to change their current power scheme

'

'Copyright Harry Sarkis Terkanian, Outermost Systems, LLC July 4, 2006

'Version 1.0.00 October 21, 2006

'

'Released under the GPL (GNU GENERAL PUBLIC LICENSE Version 2, June 1991)

'For further information or a copy of the license contact the

'Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,

'Boston, MA 02110-1301 USA.

'

'This script is released without liability on the part of the author.  Use of

'this script is at your sole cost and risk.  Your use of this script constitutes

'acceptance of these terms.

'

'----------------------------------------------------------------

'As with any script which modifies the Windows registry, care should be taken to

'backup your registry and you should independently verify that the script performs

'as desired.

'

'----------------------------------------------------------------

'Power schemes forthe current user are saved in HKCU\Control Panel\PowerCfg\CurrentPowerPolicy

'Available power schemes are stored in HKCU\Control Panel\PowerCfg\Power Policies\xx where

'xx is a string variable coresponding to the number of the policy, nuimbered from zero

'Sub keys include Name, Description & Policy.  This script retrieves the current policy and a

'list of the names of available policies and presents the user with the information and an

'opportunity to chose a different scheme.

'----------------------------------------------------------------

Option Explicit 'always!

Dim intCount, _

intConfirm, _

strCurrentValue, _

vbYesNoCancel, _

strKey, _

objShell, _

strError, _

strWhile, _

strPrompt, _

strPowerSchemeName, _

strCaption, _

strResponse

strCaption = "Power Scheme Chooser" 'MsgBox and InputBox caption

strPrompt = "Your current power scheme is: " 'beginning of prompt

vbYesNoCancel = 3 'InputBox: display yes & cancel buttons

intCount = 0 'counter for power schemes loop

strError = "False" 'Error flag, "True" if error condition exists

strWhile = "False" 'While loop control

strKey = "HKEY_CURRENT_USER\Control Panel\PowerCfg\"

Set objShell = CreateObject("WScript.Shell")

'verify we can read the registry key by reading the current value and trapping any error

On Error Resume Next 'Turn on error handling

strCurrentValue = objShell.RegRead(strKey & "CurrentPowerPolicy")

if Err <> 0 Then

MsgBox "Insufficient rights to read registry values.",0 , strCaption

strError = "True"

Err.Clear

End If

'verify we can write regegistry key values by writing it and trapping any error

if strError = "False" Then 'OK so far . . .

objShell.RegWrite strKey & "CurrentPowerPolicy", strCurrentValue, "REG_SZ"

if Err <> 0 Then

MsgBox "Insufficient rights to write registry values.",0 ,strCaption

strError = "True"

Err.Clear

End If

End If

'OK, we can read and write registry values, now build a prompt for the InputBox with

'the current power scheme and a list of available power schemes by reading power

'schemes from the registry until we come up empty (we are assuing that they are

'consecutively numbered in  the registry).  Result is strPrompt.

if strError = "False" Then 'OK so far . . .

strPowerSchemeName = objShell.RegRead(strKey & "PowerPolicies\" & strCurrentValue & "\Name")

if Err <> 0 Then

MsgBox "Cannot read name of current power scheme.",0 ,strCaption

strError = "True"

Err.Clear

Else

strPrompt = strPrompt & strCurrentValue & ": " & strPowerSchemeName & Chr(13) & Chr(10) _

& "Available power schemes are:" & Chr(13) & Chr(10)

End If

End If

intCount = 0 'initialize loop

if strError = "False" Then 'OK so far . . .

While strWhile = "False"

strPowerSchemeName = objShell.RegRead(strKey & "PowerPolicies\" & intCount & "\Name")

If Err <> 0 Then 'we are at the end of the list

intCount = intCount - 1 'oops! our count is now too high

strWhile = "True" 'exit while loop

Err.Clear

Else

strPrompt = strPrompt & intCount & ": " & strPowerSchemeName & Chr(13) & Chr(10)

intCount = intCount + 1 'next one to read

End If

Wend

strPrompt = strPrompt & "Select a power choice by entering its number." & Chr(13) & Chr(10)

'now we have the final prompt so ask the user to choose

strWhile = "False" 'another while loop . .

While strWhile = "False"

strResponse = InputBox( strPrompt, strCaption, strCurrentValue ) 'user selection, let's get the name

if strResponse <> "" Then 'usr do not cancel

strPowerSchemeName = objShell.RegRead(strKey & "PowerPolicies\" & strResponse & "\Name")

If Err <> 0 Then 'oops, we couldn't read the user's selection

MsgBox "Cannot confirm power scheme " &strResponse & " is valid, try again.", 0, strCaption

Err.Clear

Else 'confirm the selection

strWhile = "True" 'change the while loop flag

intConfirm = MsgBox( "Confirm selection of " & strPowerSchemeName & " as your power scheme.", _

1, strCaption )

If intConfirm = 1 Then 'write the selection

objShell.RegWrite strKey & "CurrentPowerPolicy", strResponse, "REG_SZ"

If Err <> 0 Then

MsgBox "Error writing new power scheme value to registry.", 0, strCaption

strError = "True"

Err.Clear

Else 'tell the user

MsgBox "Yourpower scheme has been changed to " & strPowerSchemeName & ".", _

0, strCaption

End If

End If

End If

Else 'user cancelled, so we will quit

strWhile = "True"

End If

Wend

End If

I don't want to manage them, but setting them in the first place is very useful. To do this export HKEY_CURRENT_USER\Control Panel\PowerCfg to a file, and use a text editor to replace HKEY_CURRENT_USER with HKEY_USERS\.DEFAULT.

I used the SetACL to change the registy entries as described here I can change the settings but I receive the following message:

"Not all privileges referenced are assigned to the caller."

Does anyone have ideas on how to solve this?

an April 28th entry described a tool and installer to modify the registry entries to allow the power settings to be changed.  I used the tool loged in as administrator on a test user account.  It does let me change the settings but not the power scheme.  I get the information message after I apply the new settings.

Aaron, thanks for your help..  the administrators do not have any restrictions that I can determine.  I checked HKLM and administrators have full access.

I am just curious if there is anyway to script setting the "Advanced" power options.

I have been able to script everything else except what do on "Lid Close", "Power Button" and "Sleep Button" actions.

Any ideas at all?

i would like to ask something as well. I want to be able to set the Portable/Laptop scheme to the settings i want and then apply it for the logged on user. The user must not be able to change the settings themselves though.

Any Ideas?

Hi,

what do I have to do when I create new limited users in a machine and I wan't them all to have a certain power scheme and not being able to change it?

I can't believe so many people are wanting limited users to be able to modify power settings. These are per machine settings - or at least they should be - this seems to be the real problem to me - why is there any per user component at all??? There should be one set of options that apply across everyone and only an admin can change them. MS Should fix this. It's impossible for one user to want the HDDs to spin down after 10 minutes and another to want this after 15 minutes....

Excellent piece of advice regarding changing power options :)

Currently the organisation I work for has a generic default profile, which isn't customised between desktop and laptops and the power options have been locked down via Group Policy.

The use of the above mentioned reg hack is a trouble free alternative to editing group policies without having to hassle the admin to change group policy (which I doubt he would do I might add).

Thanks :)

PingBack from http://ictfreak.wordpress.com/2007/04/20/windows-powercfgcpl-as-an-a-non-administrator/

Hi, the workaround didn't work. Does it work for limited accounts that have been created after changing the register/permission?

Sorry, don't know what happened before. Also, workaround works if accounts have been created before and after the changes to the registry.

Regarding Windows 2000:

Works with simple caveats.

1) To modify the registry use "regedt32.exe" not "regedit.exe".

2) To modify permissions use the "Security" menu from the menu bar.

The registry keys and permissions are the same.

Regarding "Not all privileges referenced are assigned to the caller":

Turns out this error can be caused by the lack of a related permission. Shutdown. Simplest way is allow all accounts to shutdown:

0) Login as Administrator

1) Goto Control Panel, and find the Administrator Tools Folders.

2) Choose Local Security Settings

3) Select "User Rights Assignment" in left hand column

4) Double-click "Shutdown the system" in right hand column

5) Add group "Users" (or a specific account)

This is some great information on how to script the various power modes and it has worked quite well.

However, I now need to script the Advanced power options - for example on Lid Close - Do Nothing; Power Button - Ask; Stand By - Do Nothing

Nothing I have done seems to work, setting up something at build time is all well and good but I currently have a large number of laptops in my environment that I need to push this change out to and with these being "per user" settings, there's no easy to way to implement.

Any suggestions?

Thank you so much for the information.

For some reason all the power schemes on my media server were deleted. When I opened power options there were no settings and I was unable to save the settings or create a new scheme. With your information I figured out were the settings were stored in the registry, exported them from one computer, imported them on the media server, and now the problem is solved.

Thanks again.

PingBack from http://twoace.wordpress.com/2007/07/25/if-power-management-is-not-working-properly-in-normal-user-laptop-user/

You might want to try this if you're trying to set up power settings with group policy. It works great:

http://www.energystar.gov/index.cfm?c=power_mgt.pr_pm_ez_gpo

I am a PC Technician for a law enforcement agency.  We have had a great deal of difficulty (and a lot of frustrations!)  with the Power Options on the laptops in our police cars.  The power options (when not set to never take effect) interfere with the operations of our police software in the cars and cause it to lock up when the officers (non administrators) are logged on.

Thanks for your help with this issue.

Aaron Margosis:

The registry permission you suggested in this article works fine if the user manually changes the power settings from control panel. However, if you use "powercfg.exe" tool, then those permissions are not enough. I had to open up the whole:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg

Give INTERACTIVE or USERS group additional rights.

David

Another question.

I thought Power Management was profile driven. Then why does the machine still follow the users power management setting, even though the user has logged off?

Does anyone know?

David

I've been able to apply this workaround successfully however I've found that the low battery alerts still don't work as expected.

With an admin user, when the battery level drops below the set limit (in my case 10%), there is a yellow stop sign popping up on the task bar and a balloon tip advising the user that the battery level is low.

With a non-admin user however, the balloon tip does not show up only the stop sign on the task bar (which gives the user no-idea what the reason for the warning)

Has anyone been able to make these alerts work the correctly?

i have had the same problem - the workaround works perfectly well , however with the low battery warning it does nt happen in the case of non admin users.

would appreciate if anyone has a workaround for this.

Regarding the suggestion in the comments above to use SetACL, I agree, SetACL is a great tool and very reliable. The suggested SetACL commands above, however, give all Users full access to the registry keys in question. To exactly implement Aaron's suggested registry permission changes, the following SetACL command will work (on the local machine):

setacl.exe -on "HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Controls Folder\PowerCfg\GlobalPowerPolicy" -ot reg -actn ace -ace "n:INTERACTIVE;p:set_val,create_subkey"

setacl.exe -on "HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies" -ot reg -actn ace -ace "n:INTERACTIVE;p:set_val,create_subkey"

PingBack from http://twoace.dobreutra.com/2007/07/25/if-power-management-is-not-working-properly-in-normal-user-laptop-user/

Tried the suggestion by Aaron, I can now set the power options as a normal user (and they stick), but the PC does not enter standby/hibernate.  The power settings still work as expected when logged in with admin rights.

Is there anything else you have to do?  Could anything else be preventing the power options working as normal user?

Aaron - There is a 'Run Program' option at the bottom of the 'Critical battery alarm' section of the Power Options.  

This does not appear when you are a non-admin.

Not only does it not appear, but more importantly, the program DOES NOT RUN when the UPS reaches critical power, even though it may have been setup properly for that user by using MakeMeAdmin.

In an earlier email exchange, you said:

---

It appears that "Run a program" makes a Scheduled Task out of the specified program.  LUA users do not have visibility into Scheduled

Tasks.  Pretty bad if that's the case.  I'm following up...

---

Is there a fix for this?  I'm Running XP SP2.

Thanks! - Les

@ghostrider and nicholas

I have the exact same problem.  None of the warning mechanisms work for non-admin accounts.  There must be another registry entry that needs to have permissions loosened in order to work.

To those of you who are having problems setting "Run a program" as a battery alert I found the problem. You need to set permissions for the entire Powercfg.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg

Follow the steps in the original post to add INTERACTIVE but make sure you do it to the PowerCfg. If you only do GlobalPowerPolicy and PowerPolicies you will not be able to set the "Run a program" battery alert.

Another thing I found out is that after you do this you need to remove your currert "Run a program" battery alert settings that you (might have) set using MakeMeAdmin and then set up the settings as a normal user (obviously you set it up after you applied my fix above).

I did this just five minutes ago after I ran into this problem and now everything works!

Thinkpad laptops come with a power utility that provides all of the local-machine flexibility desired: set up global schemes as admin, lock down (per standard XP) if desired to one scheme or allow users to change schemes or even add schemes that are specific to the user; set up machine defaults for new users; relatively usable interface (not pretty, but usable). Wished I knew how they did that so I could set up something similar at home where I have out-of-the-box XP. This blog entry has helped much. Thank you.

Does this work in Vista and 7 also?