To build a strong front line of defense for your users' machines, you must establish well-defined user groups and integrate those groups into an organizational hierarchy. But like any complex structure, these security schemes occasionally fall victim to mysterious glitches or hang-ups.
Our Technical Q&A provides a wealth of information and peer support to help you find answers to those perplexing issues. A recent Technical Q&A post demonstrates the type of support you'll find there. In one day's time, a user rights quandary was solved, affirming the need for healthy discussion and dialogue on the Net.
An unavailable Task Manager
Member William Main (wmain) asked for help troubleshooting a Task Manager mix-up. He reported a problem with a PC running Windows XP Professional. Whenever he attempted to access Task Manager from the user account, he received this error message: Task Manager Has Been Disabled By Your Administrator.
He added, "I've looked in the system policy editor and the registry and cannot find anywhere to turn this back on. It used to work. I've also searched Windows Help for 'disable task manager' and followed all of the recommendations."
Obviously, since Task Manager was once accessible on this user account, some user right has been inadvertently changed. Task Manager can be accessed by hitting [Ctrl][Alt][Delete] or by right-clicking on the Task Bar. In this particular case, Task Manager is unavailable (Figure A). Main knows the problem exists in a changed policy setting, but he cannot find the location in the system registry to make the needed changes. Fortunately, TechRepublic members were quick to point him in the right direction.
|The disabled Task Manager|
Gpedit.msc: Go, go gadget command
Both BeerMonster and email@example.com point to the Gpedit.msc command and the group policy configuration. Perform the following steps to gain access to the group policy settings in Windows XP:
- Click Start | Run.
- Enter gpedit.msc at the command line and click OK. This will open the Group Policy settings window shown in Figure B.
- Select User Configuration | Administrative Templates | System | Ctrl+Alt+Delete Options | Remove Task Manager.
- Double-click the Remove Task Manager option from the Group Policy menu. You can then disable, enable, or set the policy to Not Configured. Remember: Since the policy in question is called Remove Task Manager, by disabling the policy, you are actually enabling the Task Manager. Disabling or setting this policy to Not Configured should alleviate Main's problem.
|The Windows XP Group Policy menu|
The same procedure will work under Windows 2000, but the access path is slightly different, as shown in Figure C. Perform the following steps to gain access to group policy settings:
- Click Start | Run.
- Enter gpedit.msc at the command line and click OK. This will open the Group Policy settings window shown in Figure C.
- Select User Configuration | Administrative Templates | System | Logon/Logoff | Disable Task Manager.
|The Windows 2000 Group Policy menu|
Get out the stylebook: It's time to edit (the registry that is)
This brings us to the second solution to Main's problem. In addition to the Gpedit.msc command, a direct registry edit can produce the same results. AsyscoKid refers Main to the Windows Guide Network. The information outlined on the site provides the instructions for successfully editing the system registry to disable Task Manager.
Let me point out that when you use the Gpedit.msc utility, you're actually editing the registry; you're just doing it through a nice GUI. When you modify a policy, a particular registry key and DWORD value are created, altered, or deleted, depending on how you modify the policy. If the policy is set to Not Configured, the corresponding registry value will not exist. If the policy has been disabled, the registry value will exist but will be set to 0. If the policy has been enabled, the registry value will exist and will be set to 1.
In Main's case, the Task Manager as been disabled, so he would use the following steps to reenable it:
- Use regedit to open the Registry Editor and locate the following key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System.
- Find the DWORD value named Disable TaskMgr and set it to 0 or delete it altogether (see Figures D and E).
|The system registry location for disabling/enabling the Windows Task Manager|
|The DWORD value can be toggled to enable/disable the Windows Task Manager.|
This will make the Task Manager available again, although you might need to log off for the changes to take effect.
This same process can be used to disable the Task Manager, but you might have to create the registry key System under the Policies key. After creating the System key, create a new REG_DWORD (DWORD value) named Disable TaskMgr and set the data value to 1.