Hi, after a user has locked the computer or the screensaver locks the computer we cant use a admin account to unlock it. The text says: "This computer is locked. Only the logged on user can unlock the computer" I have tried with Fast User switching on and off but that doesnt help. Cant say if it's a GPO we use or something else. Any one got any idé?

Have a look to this Microsoft article named 'Administrator unable to unlock a "locked" computer'. Try the mentioned resolution. If it works then you can use Group Policies to change this registry entry or create a script and use it as a logon script via group policies. Remark: I recommand to create a restore point before proceeding. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Thanks for the tip. Problem is that I allready tried it. It's not the same problem I have. Mine dont say "This computer is locked. Only or an administrator can unlock this computer" just "This computer is locked. Only the logged on user can unlock the computer" So i feel that it is a settings somewhere Hope for more tips For some more info on our system: Windows 7 Enterprise SP1 Windows 2008 Forest AD

Just a try: From elevated command prompt of another computer restart the computer shutdown -r -f -m \\ip_addresss_of_locked_PC -t 0 Hoping that -f parameter may do the trick Regards Milos

Thanks Milos, Working great with a locked computer. But parhaps i didnt was clear enough. I want to change the settings for my computer so that I can use admin account to unlock the computer, GPO wise. Cant find any settings for this so that is what i´m looking for. All the computers are the same, so must be central setting and not a "bug" I hope.

Hi, Since these PCs are in domain and all have this issue, there must be some GPO settings in Windows Server to prevent administrator to unlock the PC. I suggest to contact Windows Server Forum to check if some GPO settings should be configure or change. http://social.technet.microsoft.com/Forums/en-US/category/windowsserver The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding. Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Will do. Thanks for the effort everyone. / Magnus

If you find any solution in Windows Server Forum, please feel free to let we know. Thank you for your cooperation. Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I will mark their reply as answer. It could help other communities here who have the same issue. Thanks for your understanding. Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, We have taken a round at this in the Server forum but they cant find a solution to the problem. Read here what we have done so far. It's conformed that it is not a GPO related problem as we replicated the "error" in a workgroup enviroment. So, is this a Windows 7 "feature" or is there any way to get this working like I hope? / Magnus

Hello, We at my workplace are having the same issue as well. It is definitely not a GPO problem. What we need to do is have a way to log off a user that is logged in, but Fast User Switching needs to be disabled, as it is in XP. But when these machines are locked, there's no option, like in XP, to enter administrator credentials to force log out a user. Essentially, the only thing we can do is power down the unit, but this is not an acceptable work around for us. We too would like to know if there's some workaround to force log out a user who has locked a machine by entering admin credentials.

Hi Magnus, Did this issue appear before? I will give you some other advises you can try: 1 Use both localPCname\administrator and Domain\administrator to unlock the PC. 2 Get out of the domain and let pc login with Clean Boot to see if the same issue occurs. 3 Restart the services "Remote Procedure Call (RPC)" and "Remote Procedure Call (RPC) Locator". 4 Recreate an administrator for test. Furthermore, please go to Event Viewer and share me the logs of this error, you can Upload to SkyDrive Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Leo, Answer: 1. Done both and none of them work. Same results "Only the logged on user can unlock the computer" 2. Have not got time to try this right now 3. The "Remote Procedure Call (RPC)" cant be stopped/restarted I think is because the computer is in a AD domain. The "Remote Procedure Call (RPC) Locator" isnt used in Windows 7. 4. Have allready tried a diffrent local administrator. And 2-3 diffrent domain admin accounts And no errors in Event log We got this on all the Windows 7 computers and not just one. So it isnt an isolated problem. / Magnus

If you feel free, please try the second steps. And as I know, there is a GPO on Server named “Deny log on locally”, please check if it has been set. It should located in Computer Configuration\Windows Settings\Local Policies\User Rights Assignment. Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

The “Deny log on locally” is set and the only user that are in the list is "Guest". / Magnus

Hi, In order to narrow down the issue, I feel it’s necessary to perform the tests to leave the win 7 PC alone and get out of the domain. Thank you for your understanding. Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, Have tried what you asked for, with the GPO settings we using at a local level: Interactive logon: Do not display last user name - Enabled Interactive logon: Do not require CTRL+ALT+DEL - Disabled Interactive logon: Display user information when the session is locked User display - name only I did a clean install of Windows 7 Enterprise SP1 Followed the guied to do a Clean Boot Did make a local test user and logged in with that account. Locked the computer Then tried to unlock it with the local admin account. Still says "Only the logged on user can unlock the computer" PS! Did not use Switch User as we have that disabled in our AD GPO / Magnus

Hi, Please go to Local Users and Groups in Computer Management to check the Administrator is enabled. Furthermore, I would like to verify the installation Disk of Windows 7 Enterprise SP1 is from OEM or the image you created by yourself? Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, Yes, Administrator and a second admin account, that i made for the test, is enabled. We are using SW_DVD5_SA_Win_Ent_7w_SP1_64BIT_English_MLF_X17-27625.ISO to install with. / Magnus

Hi, I think you should turn on fast user switching again for test. PS: After clean install of Windows 7 SP1, you haven’t let it joined domain, right? Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, Fast user switching is working but then I can login parallell with the logged on user and that is not an option in the domain enviroment. Computer has not been conected to the domain at all after the reinstall. / Magnus

That’s strange. I will escalate the case, another senior Engineer will help you to solve the problem. Thank you for your understanding. Regards, Leo Huang TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, Are users using smartcard, fingerprint scanning software or other biometric devices on this computer? Are these laptops or workstations? what make/model? How many machines have this issue? Does the computer have a TPM chip? Is bitlocker enabled? Sumesh P - Microsoft Online Community Support

Hi Sumesh, Q: Are users using smartcard, fingerprint scanning software or other biometric devices on this computer? A: No extra login checks then just username/pasword. Q: Are these laptops or workstations? what make/model? A: Same on all models, both laptops and workstations (Dell) Q: How many machines have this issue? A: All machines that running Windows 7 Enterprise, SP1 doesnt matter. Q: Does the computer have a TPM chip? A: Some have, some have not TPM chip. Q: Is bitlocker enabled? A: Bitlocker in not enabled. / Magnus

Hi Leo, I just wonder what happens in this case? / Magnus

I researched further and found that this behavior is by design. I do understand that this doesnt suit your needs. Customers with a Premier contract with Microsoft can submit a DCR (Design Change Request) to request product teams to review the design based on your business case (filing a DCR does not guarantee changes to design). Sumesh P - Microsoft Online Community Support

That is to bad. Wounder why they changed that from WinXP to Win7. Cant say if it was in Vista or not as I havent tried it. / Magnus

What a garbage answer to a garbage decision. I have 300 computers here that I can't unlock or switch users on, we use roaming profiles so multiple sessions screws things up big time with locked registry files and temp files and such. Way to go Microsoft team.

Hello, i posted a solution to your issue over here: http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/767d6d66-ed5f-4d59-b629-267f3ea1dcba. Feel free to provide feedback in that thread.

Hello, i posted a solution to your issue over here: http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/767d6d66-ed5f-4d59-b629-267f3ea1dcba. Feel free to provide feedback in that thread. Works great, go there and download the zip file / Magnus