Letting users change their expired passwords through RDP when connecting to a Hyper-V Windows 7 Client

We've had a problem at work where users could not log on when their passwords expired. These users are using thin clients (Microsoft Thin PC) and connecting to a server running Server 2008, with Hyper-V installed. Hyper-V is running Virtual PCs with Windows 7 professional as the OS. We require users to change their passwords once a year for security, but they were not even given the option to change their password. 

After many, many, many weeks of searching we did finally find an answer to this. Its a simple registry key that needs changing and for all you lovely people out there, here it is

The location is HKey Local Machine -> System -> CurrentControlSet -> Control -> TerminalServer -> WinStations -> RDP-TCP

The registry key which needs changing to get the VM’s to change expired password is SecurityLayer =0

This should be changed on the Virtual PCs themselves and not the thin clients.

Hope this helps people

SOLVED - Group Policy Client Service Failed The Logon

We've had this problem at work a few times now. When someone comes to log onto a computer it gives them a message saying "Group Policy Client Service Failed The Log on". Goggling this gave a lot of answers but none of them seemed to solve it. In the end we resorted to re-imaging the computer as it only took an hour. Most of the answers from Google revolved around deleting the corrupt local profile and then getting them to log back on. This never worked for us for some reason.

In the end we discovered that it was a permissions problem and not a corrupt profile problem. This is how we solved it.

1) First log on to the computer with an administrators account.

2) First make sure that 'Hide protected operating system files' is unticked in folder options. Then load up regedit

3) Click on the 'Users' Hive and then click 'File' at the top and choose 'Load Hive'


4) Browse to the users folder on the C drive and then into the profile of the account you are having a problem with. In here you will see a file called 'ntuser.dat' open this.

5) It will ask you for a name. Give it any name, it doesn't matter what it is.

6) You will now see the hive you just loaded with the name you gave it under the users hive.

7) Right click on this hive and choose 'Permissions'

8) In here you should see three accounts. System, Administrators and the user name of the person who's profile you are fixing. If ANY of these are not shown it will not work. You need to add all three and then give them full control in the permissions section. There may also be a user called 'restricted'. you can add this if you want but it will work without it. In the picture below you will see that a username is not there. You will need to add it.


9) Once you have added all three and given them the correct permission you can close it and then close the registry.

10) Log off

11) Get the user to log on and they should be fine!