Opsi client screen blocking behaviour

[sanzz]

Hello, I have tried OPSI version 4.0.1.24 and client 4.0.1.26 on Windows 7 on several machines. I have a question, that is associated with client logon screen blocking behaviour. For example, if the 'opsiclientd' service is not responding (hangs or does not start in 120 seconds) the user cannot login to the system. In the opsiclientd.conf file is presents the following parameters:

[event_gui_startup]
super = default
type = gui startup
name = gui_startup
block_login = true

and

wait_for_gui_timeout = 120

if I change block_login to false and set wait_for_gui_timeout to for example 20, and trying to emulate the situation in which the 'opsiclientd' service is not running, I cannot login to the operating system for about 2 minutes (120 seconds) during of them I can see only empty screen without forms for login\password input. So, my setting for wait_for_gui_timeout is ignoring.
My question is about how I can reduce the time period in which it will be possible to login to the operating system if for example the opsiclientd service is not started successfully - because it is the possible situation and it may annoy users. Thanks.

[d.oertel]

Hi,

at first, you should not accept that the opsiclientd does not start and try to fix this instead of working on problems that may follow.

At:
http://download.uib.de/opsi_stable/doc/ ... psiclientd
you see wther to start the loginblocker or not.

The timeout is set by the Installation via the config.ini file and stored at

Code: Alles auswählen

part of the installation code:
openkey [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{d2028e19-82fe-44c6-ad64-51497c97a02a}]
set ""="OpsiLoginBlocker"
set "LoginBlockerTimeoutConnect"=reg_dword:$OLB_LoginBlockerTimeoutConnect$
set "StartOpsiCredentialProvider"=reg_dword:0x00000000

does this help ?

regards

d.oertel

[sanzz]

Hello, Detlef. Thanks, the information provided by you was helpful enough. That was actually the answer, I've been looking for. May I ask you the one more thing: is it possible to set all of the clients not to block_login (set it to false) by specifying certain server host parameter. I've read about this on the forum (opsi version 3.4 and Windows Vista) and I want to clarify this possibility for opsi 4 and Windows 7 clients. Of course it is possible to set the security rights on the opsiclientd.conf file and to change it via group policy and special script on all clients, but the way with server host parameter is looking more smart I think. Could you make this question plain? Thanks!

[sanzz]

If I correctly understood the manual, the server host parameter will be the same -
opsiclientd.event_gui_startup.block_login=false. Am I correct?

[d.oertel]

Hi,

yes - you are right.

There is a difference that should keep in mind:
The opsi-client-agents product property 'loginblockerstart' controls wether the login-blocker is installed or not (on NT6).
If it is installed it will start and block until some one tells to stop blocking (or timeout).
The Event configuration like 'opsiclientd.event_gui_startup.block_login=false' tells the opsiclientd to tell the running loginblocker to stop blocking.

regards
d.oertel