aCTIVE Desktop issues/?/...

[King Grover]

I got this issue that keeps occuring on a select few machines.

we are in the process of migrating pc's from Novell to AD and there are some pc's that will popup the Active Desktop when the user loggs in. the users are int he power user group (WinXP) and if i were to do a simple log off anf log on it seems to be ok, but if i am to actually re-boot the machine, i get the active desktop and no login script.

I'm wondering if anyone has seen or heard of anything like this. it almost seems like a macro virus attached to the desktop.ini or somethign.

very odd

[NooNoo]

Do these machines autologin when the do the active desktop bit?

[King Grover]

the machines appear to only display the active desktop when the network is not present and i log on to the domain with cahed credentials.

log on to the local machine is fine. also cannot ping this IP. machine name registers with DNS, but the IP is unreachable through a ping

[NooNoo]

network not present... because it's unplugged or it's not pulling an ip? netbios box need ticking?

[King Grover]

If I unplug the line and log in with credentials, I get the active desktop. we fixed the IP ping issue. it turns out that these machine were not placed into the proper OU, therefore they were not getting the windows firewall settings pushed down through group policy. once they were added to the OU, the firewall settings are in tact and and we can ping and DameWare the machine.

[NooNoo]

Keep fishing around there.. it's still not pushing all the policies for that machine...

[King Grover]

we found a couple registry keys that are a part of this whole deal.

for one, we found that we needed to add a new key [NoActiveDesktop} to the current user adn the local machine policies.

then we found that the base image these machines were created from has two keys called ForceActiveDesktop with values of 1 in both cases and since the latter key was on the image, were thinking that is why it is winning the battle of two offsetting registy keys. We're going to try and disable the ForceActiveDesktop key though group policy or login script, but this whole thing still seems like and open ended mystery. I just don't know if I can leave it sit like that without knowing the exact "why" and "how" this happend in the first place.

[NooNoo]

forceactivedesktop is a key used by a spyware....so whoever made the image made it on a not quite squeaky clean machine...

[King Grover]

do you have sepcifics on this spyware at all? or ports or where force comes from?

[NooNoo]

not specifically, there is a case of it here but no particulars, but it shows up as a downloader at macafee and a false spyware package called spywareno!

[King Grover]

Holy crap! We found it. there is a wallpaper policy in effect for certain depts. this policy got moved into the wrong group where the members of this group did not have access to the .bmp file that was set as the wallpaper. in order to use a policy to set a group wallpaper, ActvieDesktop needs to be enabled and it is in this group policy, however if the users can not see the $hare or the file itself, we have the problem that we have.

dag yo, i feel so much better now that we got this thing licked!

Thanks Noo

[NooNoo]

Heh, Noo the sounding board... I didn't do nothing!

[King Grover]

nah, if you weren't here replying, i probably wouldn't have kept digging and woodn't have finded the answer.!

props babe!

[NooNoo]

glad your keeping sesame street in order!

[King Grover]

I do what I can.

that problem and fix can be added to whatever database/log/thinggydoohickiemabob now!