Error when setting Display information about previous logon on Wins 7

We recently try to deploy a GPO on our network to show previous logons during user logon. The setting is located in Computer Configuration| Policies | Administrative Templates | Windows Components | Windows Logon Options | Display information about previous logons during user logon = Enabled. Our domain level is set to Windows Server 2008. I verified that it is Windows Server 2008 on Domain and Trust.

Here is the article about this setting

Active Directory Domain Services: Last Interactive Logon

But after we deploy the setting, we are no longer able to login to any of our windows 7 machines. All of them got an error message said : “Security policies on this computer are set to display information about the last interactive logon. Windows could not retrieve this information. Please contact your network administrator for assistance.”

The setting worked on windows server 2008. I was able to login to DC and revise the setting, so we can log back in the windows 7 machines.

Anyone has experience this issue before? I looked up all of the web and only thing they said is to make sure the domain functional level must be set to Windows Server 2008, which it is.

Thanks Andrew, I already looked at the first link, no help. Other 2 links is not related to my issue.

Thanks Slartybart, I applied the GPO on all our machines on the network, including our DC (Server 2008), MS (Server 2008) and workstations (Wins 7), which about 100 machines. We were able to login to DC with the previous logons display, but not the workstations.

Bill,

Thanks for the reply again. Sorry, not much of help here. First link is not working for me. Second and third are not related, I don't have issue push out GPO from our DC, just the setting is not working for us. That is the reason we are getting the error when we login, as soon as I disable the setting in DCs and gpupdate. I was able to log in fine. Since the setting is working on DCs and possibly on the MS. I am goin to enable them first, then may retry on few of wins 7 again later to see what happen. Will post the finding later. Hopefully, enabling the DCs first will trggier settings to work. Also, I forgot mention that we been doing lot of STIGings on our machines per requirment. Not sure if one of our STIGings setting may have prevented wins 7 from working.

Good news all, I finally got the setting working. The trick is apply the setting on the DC first, let it propagates, then apply the setting on wins 7 machines. or you can do this that works for me is as soon as you apply the setting on DC, do gpupdate /target:computer (updates computer configuration on the GPO). Reboot your window 7 machines, it should take effect after reboot. I guess my issue was that I applied the setting on the network all at once, somehow the setting did not propagate correctly. Thanks for everyone's help. Till next time. :)