Making a change in Group Policy in Safe Mode or rather trying...

Question

I need to make a change in the domain controller group policy in the following:
We are trying to emulate using smart cards on our system. So I got a set of instructions which basically said to access the Local Group Policy editor under  Computer Configuration>Windows Settings>Security Settings>Local Policies>Security
Options and change 'Interactive logon: Require smart card' to 'enabled'.
Then go to the registry: 'HKLM\Software\Mocrosoft\Windows\CurrentVersion\Policies\System' and change the DWORD value of 'scforceoption' from '1' to '0'. So if you don't want to use a smart card, you can hit Esc and logon with userid/password.
Well, since I want this to happen on all our servers and workstations, I set it in the domain group policy instead of locally.
Under 'Computer Configuration>Policies>Windows Settings>Local Policies>Security Options>Interactive Logon: Require smart cards - enable'
Now it wants a smart card only. Of course we don't have them. Yes, I am mightily embarrassed.
I am in Safe Mode with Networking, but it doesn't let me get into the Group Policy. Is there a way to get in?
Win 2008 R2 with all the nasty STIGs of course.
Stef<with my fingers crossed>

Answer 1

oh dear :(
the policy setting, and the registry key/value, you have mentioned, are exactly one and the same thing.
it doesn't quite make sense, that you would enable this setting via GPedit and then also disable in the registry editor - you are setting the value to be=1, then setting the exact same value to be=0.
when wishing to use smartcards, but, not enforce the use of smartcards, you don't need to do any of this at all.
when the smartcard drivers are installed, the credentialsUI automatically changes (it detects the SC provider) and offers SClogin methods. This has been my experience over quite a few years since Win2000, and includes Win7.
I'm not sure about Win8 + smartcards, I haven't spent time with that combination yet.
It *might* be possible for you to try:
on a workstation (a domain member),login with a local account. (that part may not work).
when logged on to the workstation, open regedit, and navigate to the regkey for scforceoption. edit the ACL on that regkey to revoke/deny all permissions to all security principals *EXCEPT* for your local account.
(this should stop the GP CSE from applying the domain GP setting to the regkey).
then, reboot the workstation, logon with a domain admin account, and edit your Domain GP to remove the scforceoption setting. allow Domain GP to replicate. then try another member workstation or server to see how it goes.
I haven't ever tried this, but if you can logon and edit that setting, you'll be ok.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)