Managing Power Options as a non-administrator

As I mentioned in previous posts, the “Power Options” Control Panel applet is a particular sore spot for non-administrators.  Because clicking “OK” causes per-machine and per-user settings to be written, the only way to change the per-user settings is if the user is an administrator and can change the per-machine settings at the same time.  A workaround I presented in an earlier post was to use the MakeMeAdmin script to temporarily grant your normal account admin privileges and to then run powercfg.cpl from that elevated status.


MakeMeAdmin requires that the user know the local administrator password.  If you want to give users the ability to manage power settings without giving them the admin password, or if you just don’t want to go to the trouble of running MakeMeAdmin to manage Power Options, another alternative is simply to change a couple of registry permissions.


Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.


This description assumes that you want to allow any interactively logged-on user to adjust Power Options.  If you want to allow another specific user or group that ability instead, replace “INTERACTIVE” below with the user or group you want.


I’ll repeat, though:  all the caveats about the really bad things that can happen if you mess up in the registry editor apply here.


Also, these instructions are specific only to Windows XP.  I believe that additional steps are needed in order to make this work on Windows 2000.


  • Run Regedit.exe as an administrator
  • Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg
  • Right-click on the “GlobalPowerPolicy” key and choose “Permissions”.
  • Click on the “Advanced” button.
  • Click “Add”.
  • Type INTERACTIVE and click “Check names”, then OK.
  • Check the “Set value” and “Create Subkey” checkboxes in the “Allow” column, and click OK, then OK, then OK.
  • Do the same thing with the “PowerPolicies” key.

No reboot is required.  You can now manage your own power options without needing to be an admin or use MakeMeAdmin.

Comments (93)

  1. Bill Arnete says:

    Now how about a way to view the calendar in the time/date applet without being an admin?

  2. Robert Townley says:

    Thanks for this tip. Have you heard any reason as to why allowing the user to manage the power settings is considered some kind of security risk? I could see it on servers, but i have not been able to imagine any for a laptop.

  3. Robert, I agree that for a single-user system it probably does not represent a significant security issue. However, it is a system-wide setting, and regular users are generally not allowed to change system-wide settings. The permissions that I suggest overriding are inherited from the root of HKLM.

  4. Norman Diamond says:

    Part of Robert Townley’s question mentioned that he could see why power settings could be a security risk on servers. I wonder, but can’t quite figure it out.

    If a server is in a moderately public place (e.g. a desk next to the desks of all workers in a department) then surely power settings aren’t a security risk. If a person presses Ctrl-Alt-Delete, but the option to shut down is greyed out because the person doesn’t know an administrative password, then the user has to pull the power cord instead.

    If the server is in a protected place but the screen, keyboard, and mouse are publicly accessible, then … I’m still trying to figure it out. Why would this be the server’s screen, keyboard, and mouse? Why wouldn’t it be a client PC?

    Though I guess the security risk is real on such a client PC. One would not want public users to be able to invoke shutdown by any means even though they’re logged in, and would not want to let them access the Start menu etc. Public users should only get to do whatever is permitted by some dedicated program. When Windows 98 blue-screens on a client PC, public users don’t even get to reboot it, they only get to report it to administrators.

  5. Norman – think "terminal server".

  6. tonyso says:

    If you have not read Jen’s article on LUA, you should be asking yourself why not?

    This article…

  7. Complete list of Aaron Margosis’ non-admin / least privilege posts, for easy lookup.

  8. james A says:

    Can anyone tell me if there is a registry tweak to make a laptop hold specific power settings for every user that logs in? I have a unique situation with laptops that can never shutdown. I can set it to do that for me, but as soon as another user logs in, their profile has different power settings. many hundreds of users on these particular laptops. Thanks

  9. gary m. says:

    james A – yeah, load NTUSER.DAT (from the Default Users profile directory) as a temporary hive under HKEY_USERS. Export your power settings from HKEY_CURRENT_USERControl PanelPowerCfg and then import them* to this temporary hive under HKEY_USERS. It won’t help for existing accounts but all newly created accounts will inherit your power settings.

    * Before you can import the .REG file you’ll need to edit it to change the regkeys to the name of the temporary mounted hive.

  10. Eddy Martell says:

    Gary M. I don’t understand how to add "load NTUSER.DAT (from the Default Users profile directory) as a temporary hive under HKEY_USERS" I’m a little new to this, can you help me out.

  11. tonyso says:

    Get your friends and family, all those folks that come to you for computer help once their machines have…

  12. BillR says:

    This is one request my users wanted. Thanks for taking the time to figure it out. Since I cannot find a Group Policy setting to control the Power Options, I’ll have to resort to changing each machine. Even with Remote Registry Connection it’s tedious. At least there is a way to satisfy the users.

    Thanks, Bill

  13. BillR says:

    Instead of going to each local registry, can changing security permissions be scripted? Thanks, BillR

  14. Bill —

    Group Policy is the preferred way.

    Startup scripts would be another way.

  15. Drew says:

    What would these ‘additional steps’ be for Win2K? And if you have anything for Win 98 (yes yes, i know, shame on me, but I work for a school) then that info would be all the more appreciated.

  16. Drew – I vaguely remember something about the user needing to have the "Create pagefile" privilege on Win2k – probably because of the "hibernate" feature. I haven’t tested so this may not be accurate.

    On Win98 there are no issues with permissions. Anyone can change power settings.

  17. Klaus A says:

    It would be nice to have this as a "run once" script, to be used when setting up a (stand-alone / no domain network) computer after install. Could this be done from a script?

    /Klaus A

  18. Richard Parry says:

    In relation to Windows 2000:

    Google for regperm.exe

    Download to your PC and from that location run the following command

    REGPERM \COMPUTERNAME /K "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfg" /A:Everyone:F /R

    Combine this with PSEXEC and a list of PCs and voila! 😉

  19. Peter Olson says:

    What brainiac thought of pressing the power button to get out of standby? The same one that put shutdown under start? What genius decided users couldn’t change power settings within their own local profile, then decided that power settings wouldn’t be available from an admin template in Active Directory (you need to install a third party client and template). What think tank rolled out SP2 so that when you copy power settings to the default profile and then run sysprep, it reverts them back to the defaults? The calls to the helpdesk over this, people pulling power cords cause their computer wont turn on or off, gawd. boneheaded.

  20. Johnny Bravo says:


    Thank you so much for your registry tip. I have been a long-time W2K user and just switched to XP (Pro) on my home desktop system last month. I was quite disappointed and fustrated that as a limited user, I couldn’t change my own power settings. I knew there had to be a registry hack for this and thanks to Google, I found your blog. Many thanks and keep up the great work you’re doing. Cheers.

  21. Etek says:

    This doesnt work in W2K

  22. Brucen says:

    I did Google for regperm.exe but it looks like the author of RegPerm.exe has moved his site from the Univ of Wisc. Anyone know where I could get the .exe and a list of the syntax and switches so I could use the login script technique described by Richard Parry above?

    I have been able to allow users on our Win2K systems to access power options after manually adjusting reg permissions as described above.

    Also, has anyone successfully automated the configuration of the power options themselves for all current users on a particular machine (without using Group Policy)?

  23. says:

    Why not just apply the registry permission hack through GPO via Computer Configuration -> Windows Settings -> Security Settings -> Registry?

  24. SamUSTC says:


    Thanks a lot for your tip.

    Now I have another question, how can I change the power button scheme without entering control panel?

  25. Rob says:

    Hi, how would you put this reg script into an adm file?


  26. Rob says:

    Any idea where in the registry the actual values (time) are for ‘Turn off monitor’ and ‘Turn off hard disks’ are? Can’t seem to find it.

  27. dsfsdfsdfsdf says:

    @Bill Arnete:

    I actually found a way. I wrote my very own timedate.cpl replacement which simply runs a specified program. The program is "Rainlendar" with a very delicate Windows Classic skin, which behaves very similar to the original applet.

    For version 2.0 of this applet, I grabbed the original source from leaked Win2K source code and I’m fixing it up. For Version 3.0 I planned to add the additional NTP dialog from WinXP + Style support, and of course linking to the correct HelpIDs.

  28. Jon says:

    Please (pleasee, please) can you find a way to get this to work for win2k? The regedit option "Right-click on the “GlobalPowerPolicy” key and choose “Permissions”. " just aint there and I can’t see an alternative. I’ve searched high and low for a solution and can’t find one.

    Seems mad to me that users can’t mod their power settings, mbut hey ho.


  29. Jon, on Windows 2000 you need to use regedt32 instead of regedit to change permissions on keys. Select the key, then choose Security/Permissions on the menu. On Windows 2000 you _may_ also need to grant the user the "Create a pagefile" privilege, but I haven’t verified this.

  30. Tony Warmsbecker says:

    This works great. Just one more option: Allow non-admin in XP to enable hibernate. This requires creating the hiberfil.sys file in the root. Any Ideas? I could not find any info on the create pagefile permission.

  31. Murmansk says:

    I´m a system administrator, and have this problem with every new computer we install (more accurately: with every first logon of a user in any computer)

    Configuring every computer is a headache for us, so we were looking for a way to solve this problem with a start script.

    The problem was that if yougain Administrator access in the script, you can change the power options, but only for the Administrator, not for the current user.

    The solution comes in two steps:

    First, we need to change the registry permissions, so the user can make changes

    Second, set the desired power scheme using the powercfg.exe command line utility

    1.Changing registry permissions

    You can change the permissions of a registry key using REGINI (Microsoft KB245031). It works well with XP, and you only have to create a file with the keys AND SUBKEYS (very important to include all the subkeys) with the rights for all users.

    The command will be something like this

    \serverpublicfolderregini.exe \serverpublicfolderpower.txt

    And the file power.txt like this

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfg [7 21]

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgGlobalPowerPolicy [7 21]

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgPowerPolicies [7 21]

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgPowerPolicies [7 21]

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgPowerPolicies1 [7 21]

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgPowerPolicies2 [7 21]

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgPowerPolicies3 [7 21]

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgPowerPolicies4 [7 21]

    RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgPowerPolicies5 [7 21]

    The problem is that the only one who can change the permissions of HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfg is the administrator. So you need to run the REGINI command under the Administrator account, usually with something like CPAU.EXE (

    So, the final command will be:

    \serverpublicfoldercpau.exe -u DOMAINadminuser -p Password -ex "\serverpublicfolderregini.exe \serverpublicfolderpower.txt" -lwp

    (you can avoid showing the adminuser password using a "job" for CPAU.. read the documentation!!)

    2.Setting the desired power scheme

    Now it´s easy. You only need to use the powercfg command to select the power scheme you need. The user can change the power scheme because now he has access to the required registry keys.

    The command we use is

    \serverpublicfolderpowercfg.exe /setactive "always on"

    Ok, thats all!!

    PD:I beg pardon for my English

  32. Darth Scream says:

    For me, Regini.exe did not work, I was pulling my hair out, even using [1 5 7 11 14 17 21] in the txt file. (regini changepowercfgreg.txt) It said it changed the registry permissions, but after logging in as a local user it still failed.

    I used SETACL
    to do this.  

    [Aaron Margosis, Dec 27 2006:  corrected the URL that Darth Scream posted – belongs to a typo-squatter.]

    In the batch file, we did:

    setacl.exe -on “\%computername%HKLMSOFTWAREMICROSOFTWindowsCurrentVersionControls FolderPowerCfgGlobalPowerPolicy” -ot reg -actn ace -ace “n:%computername%users;p:full”
    setacl.exe -on “\%computername%HKLMSOFTWAREMICROSOFTWindowsCurrentVersionControls FolderPowerCfgPowerPolicies” -ot reg -actn ace -ace “n:%computername%users;p:full”
    setacl.exe -on “\%computername%HKLMSOFTWAREMICROSOFTWindowsCurrentVersionControls FolderPowerCfg” -ot reg -actn ace -ace “n:%computername%users;p:full”

    Then we ran Powercfg with the switches we wanted to configure the Current user settings.  Just in case anyone else had this issue.

  33. B. Goodman says:

    OK, taking this one step further, can anybody tell me how to allow a user to CHOOSE and existing power management scheme WITHOUT BEING ABLE to change the scheme settings?

  34. Help says:

    HELP PLEASE…. I tried this hack on my XP Media Center Edition and seemed to have broken something.  The non-admin account has developed this problem where the screen suddenly goes very dim.  I’ve reversed the registry changes and no luck.  To make matters worst, I forgot the golden rule and forgot to backup the registry before the changes.  The dim screen follows when I log off from the user account to the login screen, but clears when I login to the admin account.  

    Has anyone made this work on the XP MCE?  Any ideas on what could have gone wrong?  

  35. "Help" – what power settings/scheme are currently defined for the non-admin user?  Also, do you have any 3rd party power management tools on the system?

  36. miss_j says:

    thanks for this article,here have a cookie *smiles* i will try this registry hack since power scheme has been buggin me for a while.

  37. Charles Haven says:

    I have put together an installer created with NSIS that allows a Limited User Account to change the Power Options. It is based on the comments above by Murmansk and Darth Scream.

    The NSIS script can be found here:

    An installer created based on script can be downloaded here:

  38. Brad says:


    Can you help?

  39. Brad says:

    I wanted to provide a little more information. I am a regular user logged onto a domain, and I tried the above suggestions and got the response noted above. Here is a screen capture.

    Any help would be appreciated. I run ITUNES and when the computer I use goes into standby, other users that I am sharing music with cannot use my shared music.

  40. Brad – you need to run regedit as admin to make that change.

  41. Brad says:

    Oh I thought the whole point of this article was that you could do this without being an administrator??

  42. Brad – Almost.  The purpose here is to allow non-admins to manage power options for the computer.  An administrator needs to make that decision and apply the change.  Then non-admins can use the Power Options applet.

  43. Dennis Peters says:

    Check out this site.  Somebody wrote a template for a custom addin for a GPO to manage power options, along with a small client piece.  Worth the download…

  44. Tim Baldoni says:

    The following works for me:

    regperm.exe /K "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgGlobalPowerPolicy" /A:INTERACTIVE:QWCE /E /R /I

    regperm.exe /K "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfgPowerPolicies" /A:INTERACTIVE:QWCE /E /R /I

  45. DrewH says:

    Another simple fix for non-GPO might be to do a VBScript for both XP & 2000 that you place ro run for all users and place a delete script at the end of the command, the Power Scheme "Always On" is set on both XP & 2000 by default to just power down the monitor, no HD power down, stand-by, etc.

    Do a oShell.RegWrite "HKCUControl PanelPowerCFGCurrentPowerPolicy", "3" in the VBScript.  PowerPolicy 3 is "Always On"

    BTW – the EZ_GPO tool is excellent and I would def recommend in areas using AD

  46. Michiel says:

    Thanks this is great

  47. WhooTAZ says:

    I created a master PC and it had turn drives off at 1 hour.  It was not changed and this was used to Clone to 17 other new indentical PC’s.

    The issue is we have sessions to an AS400 session and the 1 hour limit on the hard drive plays havoc on the sessions.  

    What is my way to get around this?  

    I changed Administrator to ALWAYS ON and when a new domain user gets created on the new desktop PC it still show 1 hour time limit for the hard drive to shut down.

    This is NUTS

  48. Charles Haven says:

    That’s the point of this post! When you change the Power Settings while logged-in and Administrator you are changing the settings for just Administrator, not "the machine".

    The real problem comes when a user administrator priviledges logs in. He does not have the permission to change the Power Settings. Hence the above work-arounds.



  49. Hilda says:

    > If you want to allow another specific user or group that ability instead, replace “INTERACTIVE” below with the user or group you want.

    INTERACTIVE works for me, but I haven’t had success substituting the name of a defined-by-me user group.  I still get a no-access error when I try to apply new power management settings.  Has anyone been able to do this?

  50. Fred says:

    Thanks All for your help !!!!!!!

  51. Matt says:

    We are in a rather large enviornment that allows some of the users to have access to the power settings and others not to.
    The users who are not allowed to change the power settings are in a group that has most everything locked down.

    We have tried the interactive solution, which worked for a little while, then a Domain update happened and knocked out interactive.

    I have also tried implementing that group having full permissions to the power settings but it is still not working.

    My options are somewhat limited. I am part of the help desk, but I am not the Windows Administrator.

    I need a way to set it up without any external programs (those would have to go through all the red tape to get approved)so that either the users could change the settings themselves, or set it through group policy or something to have the computer “Always On” One thing that I have found in the past through experimentation is to delete the registry keys  1-6 under the power policies (this kept the computer up 24/7 with no problems, but TechTeam said we should never delete ANY registry keys.)

    Can anyone help?

    What kind of “domain update” rolled back the registry permission changes you had implemented?  I would think that a good solution would be to set a Group Policy to change the permissions as described in this post, granting permissions to the groups that need them.

    — Aaron

  52. Tim says:

    James A said "Can anyone tell me if there is a registry tweak to make a laptop hold specific power settings for every user that logs in? I have a unique situation with laptops that can never shutdown. I can set it to do that for me, but as soon as another user logs in, their profile has different power settings. many hundreds of users on these particular laptops. Thanks"

    I would like to know what about existing user accounts?  gary m gave a way to fix this for new accounts.  Which is great!

    However, I have a bunch of computers that have multiple user profiles.  I don’t need to give them rights to change the power settings, but I want a way to login as Admin, change the power settings, and have this setting take effect no matter who is logged in.  In other words the admin account changes the power settings for the computer, not just the admin account.  Can this be done?  Thanks in advanced.

  53. grouse says:

    I wanted to change the power settings without giving everyone the right to change them. I think to do this you must copy the power settings you want to the registry for the Default User (HKEY_USERS.DEFAULT).

  54. Harry Terkanian says:

    Script to display the current user’s power scheme and available power schemes and allow an unprivileged user to chose between (but not modify) them.

    ‘VB script to allow Win2K and WinXP users to change their current power scheme

    ‘Copyright Harry Sarkis Terkanian, Outermost Systems, LLC July 4, 2006

    ‘Version 1.0.00 October 21, 2006

    ‘Released under the GPL (GNU GENERAL PUBLIC LICENSE Version 2, June 1991)

    ‘For further information or a copy of the license contact the

    ‘Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,

    ‘Boston, MA 02110-1301 USA.

    ‘This script is released without liability on the part of the author.  Use of

    ‘this script is at your sole cost and risk.  Your use of this script constitutes

    ‘acceptance of these terms.


    ‘As with any script which modifies the Windows registry, care should be taken to

    ‘backup your registry and you should independently verify that the script performs

    ‘as desired.


    ‘Power schemes forthe current user are saved in HKCUControl PanelPowerCfgCurrentPowerPolicy

    ‘Available power schemes are stored in HKCUControl PanelPowerCfgPower Policiesxx where

    ‘xx is a string variable coresponding to the number of the policy, nuimbered from zero

    ‘Sub keys include Name, Description & Policy.  This script retrieves the current policy and a

    ‘list of the names of available policies and presents the user with the information and an

    ‘opportunity to chose a different scheme.


    Option Explicit ‘always!

    Dim intCount, _

    intConfirm, _

    strCurrentValue, _

    vbYesNoCancel, _

    strKey, _

    objShell, _

    strError, _

    strWhile, _

    strPrompt, _

    strPowerSchemeName, _

    strCaption, _


    strCaption = "Power Scheme Chooser" ‘MsgBox and InputBox caption

    strPrompt = "Your current power scheme is: " ‘beginning of prompt

    vbYesNoCancel = 3 ‘InputBox: display yes & cancel buttons

    intCount = 0 ‘counter for power schemes loop

    strError = "False" ‘Error flag, "True" if error condition exists

    strWhile = "False" ‘While loop control

    strKey = "HKEY_CURRENT_USERControl PanelPowerCfg"

    Set objShell = CreateObject("WScript.Shell")

    ‘verify we can read the registry key by reading the current value and trapping any error

    On Error Resume Next ‘Turn on error handling

    strCurrentValue = objShell.RegRead(strKey & "CurrentPowerPolicy")

    if Err <> 0 Then

    MsgBox "Insufficient rights to read registry values.",0 , strCaption

    strError = "True"


    End If

    ‘verify we can write regegistry key values by writing it and trapping any error

    if strError = "False" Then ‘OK so far . . .

    objShell.RegWrite strKey & "CurrentPowerPolicy", strCurrentValue, "REG_SZ"

    if Err <> 0 Then

    MsgBox "Insufficient rights to write registry values.",0 ,strCaption

    strError = "True"


    End If

    End If

    ‘OK, we can read and write registry values, now build a prompt for the InputBox with

    ‘the current power scheme and a list of available power schemes by reading power

    ‘schemes from the registry until we come up empty (we are assuing that they are

    ‘consecutively numbered in  the registry).  Result is strPrompt.

    if strError = "False" Then ‘OK so far . . .

    strPowerSchemeName = objShell.RegRead(strKey & "PowerPolicies" & strCurrentValue & "Name")

    if Err <> 0 Then

    MsgBox "Cannot read name of current power scheme.",0 ,strCaption

    strError = "True"



    strPrompt = strPrompt & strCurrentValue & ": " & strPowerSchemeName & Chr(13) & Chr(10) _

    & "Available power schemes are:" & Chr(13) & Chr(10)

    End If

    End If

    intCount = 0 ‘initialize loop

    if strError = "False" Then ‘OK so far . . .

    While strWhile = "False"

    strPowerSchemeName = objShell.RegRead(strKey & "PowerPolicies" & intCount & "Name")

    If Err <> 0 Then ‘we are at the end of the list

    intCount = intCount – 1 ‘oops! our count is now too high

    strWhile = "True" ‘exit while loop



    strPrompt = strPrompt & intCount & ": " & strPowerSchemeName & Chr(13) & Chr(10)

    intCount = intCount + 1 ‘next one to read

    End If


    strPrompt = strPrompt & "Select a power choice by entering its number." & Chr(13) & Chr(10)

    ‘now we have the final prompt so ask the user to choose

    strWhile = "False" ‘another while loop . .

    While strWhile = "False"

    strResponse = InputBox( strPrompt, strCaption, strCurrentValue ) ‘user selection, let’s get the name

    if strResponse <> "" Then ‘usr do not cancel

    strPowerSchemeName = objShell.RegRead(strKey & "PowerPolicies" & strResponse & "Name")

    If Err <> 0 Then ‘oops, we couldn’t read the user’s selection

    MsgBox "Cannot confirm power scheme " &strResponse & " is valid, try again.", 0, strCaption


    Else ‘confirm the selection

    strWhile = "True" ‘change the while loop flag

    intConfirm = MsgBox( "Confirm selection of " & strPowerSchemeName & " as your power scheme.", _

    1, strCaption )

    If intConfirm = 1 Then ‘write the selection

    objShell.RegWrite strKey & "CurrentPowerPolicy", strResponse, "REG_SZ"

    If Err <> 0 Then

    MsgBox "Error writing new power scheme value to registry.", 0, strCaption

    strError = "True"


    Else ‘tell the user

    MsgBox "Yourpower scheme has been changed to " & strPowerSchemeName & ".", _

    0, strCaption

    End If

    End If

    End If

    Else ‘user cancelled, so we will quit

    strWhile = "True"

    End If


    End If

  55. Michael Hoffman says:

    I don’t want to manage them, but setting them in the first place is very useful. To do this export HKEY_CURRENT_USERControl PanelPowerCfg to a file, and use a text editor to replace HKEY_CURRENT_USER with HKEY_USERS.DEFAULT.

  56. Ralph says:

    I used the SetACL to change the registy entries as described here I can change the settings but I receive the following message:

    “Not all privileges referenced are assigned to the caller.”

    Does anyone have ideas on how to solve this?

    I’m not familiar with “SetACL” (where did you get it?).  The reference to privileges leads me to infer that it is trying to enable some privileges in order to make the changes — perhaps trying to enable the Security privilege so that the SACL can be changed also.  (SACL = “system access control list” — determines whether/when security auditing occurs; vs. DACL = “discretionary access control list”, which determines who can access the resource and in what ways).  SetACL sounds like a tool that assumes you’re running as admin.  (Which you need to be if you’re changing the ACL on an HKLM key…)

    — Aaron

  57. Ralph says:

    an April 28th entry described a tool and installer to modify the registry entries to allow the power settings to be changed.  I used the tool loged in as administrator on a test user account.  It does let me change the settings but not the power scheme.  I get the information message after I apply the new settings.

    I just glanced over the source for setacl — the privileges it plays with include the backup, restore, security, and take-ownership privileges, which are all normally granted to administrators.  Do you have any of those privileges not granted to your admins?

    — Aaron

  58. Ralph says:

    Aaron, thanks for your help..  the administrators do not have any restrictions that I can determine.  I checked HKLM and administrators have full access.

  59. Roger says:

    I am just curious if there is anyway to script setting the "Advanced" power options.

    I have been able to script everything else except what do on "Lid Close", "Power Button" and "Sleep Button" actions.

    Any ideas at all?

  60. Robert says:

    i would like to ask something as well. I want to be able to set the Portable/Laptop scheme to the settings i want and then apply it for the logged on user. The user must not be able to change the settings themselves though.

    Any Ideas?

  61. PerseP says:


    what do I have to do when I create new limited users in a machine and I wan’t them all to have a certain power scheme and not being able to change it?

  62. Madz says:

    I can’t believe so many people are wanting limited users to be able to modify power settings. These are per machine settings – or at least they should be – this seems to be the real problem to me – why is there any per user component at all??? There should be one set of options that apply across everyone and only an admin can change them. MS Should fix this. It’s impossible for one user to want the HDDs to spin down after 10 minutes and another to want this after 15 minutes….

  63. Adam says:

    Excellent piece of advice regarding changing power options 🙂

    Currently the organisation I work for has a generic default profile, which isn’t customised between desktop and laptops and the power options have been locked down via Group Policy.

    The use of the above mentioned reg hack is a trouble free alternative to editing group policies without having to hassle the admin to change group policy (which I doubt he would do I might add).

    Thanks 🙂

  64. Josh says:

    Hi, the workaround didn’t work. Does it work for limited accounts that have been created after changing the register/permission?

    Josh: Are you sure you followed the directions exactly as described?  What operation fails?  Is it using the UI, or an automated command using “powercfg.exe”?

    — Aaron

  65. Josh says:

    Sorry, don’t know what happened before. Also, workaround works if accounts have been created before and after the changes to the registry.

  66. Bryan says:

    Regarding Windows 2000:

    Works with simple caveats.

    1) To modify the registry use "regedt32.exe" not "regedit.exe".

    2) To modify permissions use the "Security" menu from the menu bar.

    The registry keys and permissions are the same.

    Regarding "Not all privileges referenced are assigned to the caller":

    Turns out this error can be caused by the lack of a related permission. Shutdown. Simplest way is allow all accounts to shutdown:

    0) Login as Administrator

    1) Goto Control Panel, and find the Administrator Tools Folders.

    2) Choose Local Security Settings

    3) Select "User Rights Assignment" in left hand column

    4) Double-click "Shutdown the system" in right hand column

    5) Add group "Users" (or a specific account)

  67. Roger says:

    This is some great information on how to script the various power modes and it has worked quite well.

    However, I now need to script the Advanced power options – for example on Lid Close – Do Nothing; Power Button – Ask; Stand By – Do Nothing

    Nothing I have done seems to work, setting up something at build time is all well and good but I currently have a large number of laptops in my environment that I need to push this change out to and with these being "per user" settings, there’s no easy to way to implement.

    Any suggestions?

  68. High Camp says:

    Thank you so much for the information.

    For some reason all the power schemes on my media server were deleted. When I opened power options there were no settings and I was unable to save the settings or create a new scheme. With your information I figured out were the settings were stored in the registry, exported them from one computer, imported them on the media server, and now the problem is solved.

    Thanks again.

  69. Brendon says:

    You might want to try this if you’re trying to set up power settings with group policy. It works great:

  70. Aaron Wasburn says:

    I am a PC Technician for a law enforcement agency.  We have had a great deal of difficulty (and a lot of frustrations!)  with the Power Options on the laptops in our police cars.  The power options (when not set to never take effect) interfere with the operations of our police software in the cars and cause it to lock up when the officers (non administrators) are logged on.

    Thanks for your help with this issue.

  71. David says:

    Aaron Margosis:

    The registry permission you suggested in this article works fine if the user manually changes the power settings from control panel. However, if you use "powercfg.exe" tool, then those permissions are not enough. I had to open up the whole:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfg

    Give INTERACTIVE or USERS group additional rights.


  72. David says:

    Another question.

    I thought Power Management was profile driven. Then why does the machine still follow the users power management setting, even though the user has logged off?

    Does anyone know?


  73. Nicolas says:

    I’ve been able to apply this workaround successfully however I’ve found that the low battery alerts still don’t work as expected.

    With an admin user, when the battery level drops below the set limit (in my case 10%), there is a yellow stop sign popping up on the task bar and a balloon tip advising the user that the battery level is low.

    With a non-admin user however, the balloon tip does not show up only the stop sign on the task bar (which gives the user no-idea what the reason for the warning)

    Has anyone been able to make these alerts work the correctly?

  74. ghostrider says:

    i have had the same problem – the workaround works perfectly well , however with the low battery warning it does nt happen in the case of non admin users.

    would appreciate if anyone has a workaround for this.

  75. EricT says:

    Regarding the suggestion in the comments above to use SetACL, I agree, SetACL is a great tool and very reliable. The suggested SetACL commands above, however, give all Users full access to the registry keys in question. To exactly implement Aaron’s suggested registry permission changes, the following SetACL command will work (on the local machine):

    setacl.exe -on "HKLMSOFTWAREMICROSOFTWindowsCurrentVersionControls FolderPowerCfgGlobalPowerPolicy" -ot reg -actn ace -ace "n:INTERACTIVE;p:set_val,create_subkey"

    setacl.exe -on "HKLMSOFTWAREMICROSOFTWindowsCurrentVersionControls FolderPowerCfgPowerPolicies" -ot reg -actn ace -ace "n:INTERACTIVE;p:set_val,create_subkey"

  76. Clive says:

    Tried the suggestion by Aaron, I can now set the power options as a normal user (and they stick), but the PC does not enter standby/hibernate.  The power settings still work as expected when logged in with admin rights.

    Is there anything else you have to do?  Could anything else be preventing the power options working as normal user?

  77. Les says:

    Aaron – There is a ‘Run Program’ option at the bottom of the ‘Critical battery alarm’ section of the Power Options.  

    This does not appear when you are a non-admin.

    Not only does it not appear, but more importantly, the program DOES NOT RUN when the UPS reaches critical power, even though it may have been setup properly for that user by using MakeMeAdmin.

    In an earlier email exchange, you said:

    It appears that “Run a program” makes a Scheduled Task out of the specified program.  LUA users do not have visibility into Scheduled

    Tasks.  Pretty bad if that’s the case.  I’m following up…

    Is there a fix for this?  I’m Running XP SP2.

    Thanks! – Les

    [Aaron Margosis]  I don’t have an XP machine to test on.  What is the configuration you’re seeing for the Scheduled Task that it creates?  Are there other configuration settings that could ensure that it runs regardless of whether an admin (or anyone) is logged on?

  78. BillA says:

    @ghostrider and nicholas

    I have the exact same problem.  None of the warning mechanisms work for non-admin accounts.  There must be another registry entry that needs to have permissions loosened in order to work.

  79. Stephen says:

    To those of you who are having problems setting "Run a program" as a battery alert I found the problem. You need to set permissions for the entire Powercfg.

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfg

    Follow the steps in the original post to add INTERACTIVE but make sure you do it to the PowerCfg. If you only do GlobalPowerPolicy and PowerPolicies you will not be able to set the "Run a program" battery alert.

    Another thing I found out is that after you do this you need to remove your currert "Run a program" battery alert settings that you (might have) set using MakeMeAdmin and then set up the settings as a normal user (obviously you set it up after you applied my fix above).

    I did this just five minutes ago after I ran into this problem and now everything works!

  80. MIkeB says:

    Thinkpad laptops come with a power utility that provides all of the local-machine flexibility desired: set up global schemes as admin, lock down (per standard XP) if desired to one scheme or allow users to change schemes or even add schemes that are specific to the user; set up machine defaults for new users; relatively usable interface (not pretty, but usable). Wished I knew how they did that so I could set up something similar at home where I have out-of-the-box XP. This blog entry has helped much. Thank you.

    Does this work in Vista and 7 also?

    [Aaron Margosis]  No need to do this in Vista and Win7.  Unlike XP, Vista and Win7 focus on the standard user scenario as the default/primary scenario, so lots of things work that didn’t before.

  81. Ron says:

    I reinstalled XP on my NC10 from scratch without installing Samsung’s Battery Manager first. I can’t remember when this problem starts: The system is automically hibernated although all power options are configured not to do. Then I tried to solve this issue with installing Samsung’s Battery Manager but the problem still exists.

    What can I do?

  82. CB says:

    On 2008 Server (which is a nightmare compared to 2003 server) there is an easy workaround…

    Temporarily add Administrators, domain administrator,Schema admins, Group policy creater to the members of from Active Directory/Users, reboot there pc and login afterwards, goto power options and change what need to…. and after your done remove them from the members of  for that user and all will be fine…. remember to reboot the pc after you remove them from the Members tab…

  83. Uwe says:

    "Tony Warmsbecker 17 Jan 2006 1:10 PM #

    This works great. Just one more option: Allow non-admin in XP to enable hibernate. This requires creating the hiberfil.sys file in the root. Any Ideas? I could not find any info on the create pagefile permission."

    This is exactly my problem. Users cannot check the option "Enable Hibernation" in Power Options.

    Any suggestions?

  84. Further reg permissions info - link included - IBM / Lenovo trump Acer and Dell here, too says:

    OK, I am trying to use more advanced power options (on a laptop) than the very simple 'sleep at x number of minutes' et al.

    My Dell has its own Power Saving utility to manage, in an advanced way, the various components and subsystems of the laptop, as it SHOULD.

    However, inanely (just like the Acer it replaced, grrr!) it does NOT allow Limited Users (Users group) to do this. It gives an error about permissions.

    Er, Dell and Acer, why can't you run this stuff as a SERVICE or whatever it takes, handle security within your app, and allow limited users to access such settings – but ONLY via the utility (i.e. don't allow direct registry access to the keys in question for a limited account, to dissuade malware, but allow limited users to control the Dell utility, which then, securely, sends these requests to the service, which then effects them to the registry and system hardware)?

    It is pretty hard to follow even such basic security best practise for Windows, if even the ones who FORCE you to buy Windows with their laptops, do not actually support this system properly. In a VERY important way – power saving. I'd have a desktop if I wasn't interested in saving power for a given application, not a laptop. Yet I don't wish to either run as admin, whilst browsing the web in low-power mode (insecure), run as limited user, but waste power / have the laptop act-up in strange ways due to hidden permissions issues – nor have to hack the damn registry myself. That's what an OEM's utilities are for.

    Acer = FAIL.

    Dell = FAIL. (and I LIKE Dell otherwise…)…/delegating-power-options-management-to-limited-users-in-xp

    Shows a full (-er, maybe not complete, maybe Dell have custom registry locations to consider) set of permissions that may or may not work better, for those arriving here via a web search.

    I tried a quick run of FileMon and RegMon from Sysinternals, but haven't had time to painstakingly (note that word: pain!) go through the massive logs they generate, yet. Shouldn't have to, either. Dell and Microsoft definitely got paid to do their job – so where is the result, on this kind of issue?


    [Aaron Margosis]  Is this for XP or Win7?  Tweaking XP isn't worth the trouble anymore.  Also, check out Process Monitor — RegMon and FileMon are dead.