The config profile without a scope should just be the auth changer. You
would want the other 2 settings in a separate config profile that is
scooped to machines as those are more permanent configurations. You
shouldn't have all 3 together in 1 config...
From the sound of what the OP wants, which is just to set the Auth
Changer to the Notify screen, setting no scope for the config profile
should work since it's the first thing that runs. Even if the config
profile is removed during the Notify screen,...
