Solved Error when setting Display information about previous logon on Wins 7

[killachang]

We recently try to deploy a GPO on our network to show previous logons during user logon. The setting is located in Computer Configuration| Policies | Administrative Templates | Windows Components | Windows Logon Options | Display information about previous logons during user logon = Enabled. Our domain level is set to Windows Server 2008. I verified that it is Windows Server 2008 on Domain and Trust.

Here is the article about this setting

Active Directory Domain Services: Last Interactive Logon

But after we deploy the setting, we are no longer able to login to any of our windows 7 machines. All of them got an error message said : “Security policies on this computer are set to display information about the last interactive logon. Windows could not retrieve this information. Please contact your network administrator for assistance.”

The setting worked on windows server 2008. I was able to login to DC and revise the setting, so we can log back in the windows 7 machines.

Anyone has experience this issue before? I looked up all of the web and only thing they said is to make sure the domain functional level must be set to Windows Server 2008, which it is.

 

[andrew129260]

Have you seen this?

"Display information about previous logons during user logon"

And this?

Windows Logon Options in Vista/2008: Part One of Two - Ask the Directory Services Team - Site Home - TechNet Blogs

Network Logon Issues with Group Policy and Network - Management - Business Computing


Hopefully that helps you in some way, I will ask for further assistance if none of those links are a help to you.

 

[killachang]

Thanks Andrew, I already looked at the first link, no help. Other 2 links is not related to my issue.

 

[Slartybart]

See if this helps:
The Swede's blog: Interactive logon information

and everything you wanted to know about Group Policy
Jimmy the swede mentioins Organizational Units (OU) and GPMC
See if the MS GPMC information in the link above helps any

 

[killachang]

Thanks Slartybart, I applied the GPO on all our machines on the network, including our DC (Server 2008), MS (Server 2008) and workstations (Wins 7), which about 100 machines. We were able to login to DC with the previous logons display, but not the workstations.

 

[Slartybart]

Ok, are all of the WS Win7?

I found this tutorial: Logon Information

But it seems to be a reference to local display only and does not appear to use (OU). It does however bring me back to the Swede "Are you setting (OU) on the DC?"

I also found a few references that use Powershell scripts to manage GPO
Scripting for Group Policy
Which lead me to this: Force a Domain-Wide Update of Group Policy with PowerShell - Hey, Scripting Guy! Blog - Site Home - TechNet Blogs

I don't know if those will help, but perhaps it points you in the right direction that will solve the issue.

I guess I'm out of ideas - good luck.

I'll ask for more help from other members.

Bill
.

 

[killachang]

Bill,

Thanks for the reply again. Sorry, not much of help here. First link is not working for me. Second and third are not related, I don't have issue push out GPO from our DC, just the setting is not working for us. That is the reason we are getting the error when we login, as soon as I disable the setting in DCs and gpupdate. I was able to log in fine. Since the setting is working on DCs and possibly on the MS. I am goin to enable them first, then may retry on few of wins 7 again later to see what happen. Will post the finding later. Hopefully, enabling the DCs first will trggier settings to work. Also, I forgot mention that we been doing lot of STIGings on our machines per requirment. Not sure if one of our STIGings setting may have prevented wins 7 from working.

 

[andrew129260]

Unfortunately, no one here here seems to know the answer, I know sometimes you can get free limited support by Microsoft. I don't know if that's available to you. If you do find the answer, please let us know.

 

[killachang]

Good news all, I finally got the setting working. The trick is apply the setting on the DC first, let it propagates, then apply the setting on wins 7 machines. or you can do this that works for me is as soon as you apply the setting on DC, do gpupdate /target:computer (updates computer configuration on the GPO). Reboot your window 7 machines, it should take effect after reboot. I guess my issue was that I applied the setting on the network all at once, somehow the setting did not propagate correctly. Thanks for everyone's help. Till next time.

 

[andrew129260]

Thank you so much for putting your solution! Other people that google your problem now have something to look at. I am saying that because when I searched your issue nothing helpful came up.

 

[Slartybart]

Thanks for posting how you resolved the issue. As Andrew already said - it might might help other members or searchers solve the issue.

bill
.