How to use Powercfg.exe to create a Group Policy object for power schemes in Windows XP (915160)

MORE INFORMATION

By default, users who do not have administrator rights and permissions cannot change power scheme settings. The power schemes program changes both per-user and per-machine settings. To change the per-machine settings, you must have administrator rights and permissions. Failure to set the per-machine settings prevents the per-user settings from being committed.

Therefore, if you are a user who does not have administrator rights and permissions, and you try to use the power schemes program in Windows XP to change the power scheme settings, you receive the following error message:

Create a Group Policy object to change power scheme settings

To create a Group Policy object to change the power scheme settings, follow these steps:

1. On the domain controller, copy the Powercfg.exe file to the NETLOGON share.
   • By default, the Powercfg.exe file is located in the %systemroot%\System32 folder on a Windows 2003-based computer.
   • By default, the NETLOGON shared folder is located at %systemroot%\Sysvol\Sysvol\Domain_DNS_name\Scripts on a Windows Server 2003-based computer.
2. Click Start, click Run, type dsa.msc, and then click OK. This starts the Active Directory Users and Computers snap-in.
3. In the Active Directory Users and Computers dialog box, right-click the domain container, and then click Properties.
4. On the Group Policy tab, click New.
5. Type Power Configuration Policy, and then press ENTER.
6. Click Edit.
7. Under User Configuration, expand Windows Settings, and then click Scripts.
8. In the right pane, double-click Logon, and then click Show Files. The user's \Scripts\Logon folder appears.
9. In the user's Scripts\Logon folder, create a new batch file that sets the power scheme settings on the user's computer. To do this, follow these steps:
   1. Click File, click New, and then click Text Document.
   2. Type PowerConfig.bat, and then press ENTER.
   3. In the Rename dialog box, click Yes.
   4. Right-click PowerConfig.bat, and then click Edit.
   5. If an Open File - Security Warning dialog box appears, click Run.
   6. Type the following commands in the batch file:

      @echo off
      net use x: \\domain_DNS_name\netlogon
      x:
      powercfg.exe /change "always on" /monitor-timeout-ac 20
      powercfg.exe /SETACTIVE "always on"
      c:
      net use x: /delete
      

      Note The domain_DNS_name term that is used in the batch file is a placeholder for the DNS name of the domain controller.
   7. Click File, click Exit, and then click Yes.
10. Close the Scripts\Logon folder.
11. In the Logon Properties dialog box, click Add, click Browse, double-click PowerConfig.bat, and then click OK two times.
12. Under Computer Configuration, expand Windows Settings, expand Security Settings, and then expand Local Policies.
13. Click User Rights Assignment, and then double-click Shut down the system.
14. In the Shut down the system Properties dialog box, click Add User or Group, type the user's domain name and account name in the User and group names box, and then click OK two times.
15. Under Computer Configuration, expand Windows Settings, expand Security Settings, and then click Registry.
16. In the Group Policy Object Editor dialog box, click Action, and then click Add Key.
17. In the Selected key box, type the following entry, and then click OK:

    MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg

18. Click Add, type the user's account name in the Enter the object names to select box, and then click OK two times.
19. In the Add Object dialog box, click Configure this key then, click Propagate inheritable permissions to all subkeys, and then click OK.
20. In the Group Policy Object Editor, click Action, and then click Add Key.
21. In the Selected key box, type the following entry, and then click OK:
    USERS\.DEFAULT\Control Panel\PowerCfg
22. Click Add, type the user's account name into the Enter the object names to select box, and then click OK two times.
23. In the Add Object dialog box, click Configure this key then, click Propagate inheritable permissions to all subkeys, and then click OK.
24. In the Group Policy Object Editor dialog box, click File, and then click Exit.
25. In the domain container Properties dialog box, click OK.
26. In the Active Directory Users and Computers dialog box, click File, and then click Exit.

Configure user access to power settings

To deny permission to change the settings modified by the logon batch file, configure user access to the PowerCfg.cpl file. You can deny permission for the user to open the Power Options extension in Control Panel to view or to change the power settings. To do this, follow these steps:

1. Click Start, click Run, type dsa.msc, and then click OK. This starts the Active Directory Users and Computers snap-in.
2. In the Active Directory Users and Computers dialog box, right-click the domain container, and then click Properties.
3. Under Computer Configuration, expand Windows Settings, and then click File System.
4. In the Group Policy Object Editor dialog box, click Action, and then click Add File.
5. In the Add a file or folder dialog box, type %SystemRoot%\system32\powercfg.cpl in the Folder box, and then click OK.
6. Click Add, type the user's account name in the Enter the object names to select box, and then click OK.
7. In the Permissions for user name access permission group, click to select the Deny check box for Full Control permission, and then click OK.
8. In the Security dialog box, click Yes.
9. In the Add Object dialog box, click Configure this key then, then click Propagate inheritable permissions to all subkeys, and then click OK.