Modify your web-login and remove the oncontextmenu="return false; entries found in there.

The first attempt at this change was to update the Web-Login rule and save it to one of our application rulesets.   This change did not work because the application ruleset is not in the ruleset stack at initial login time.  It was then suggested that we look at the Browser Requestor and the access group that is associated with that requestor.   We create a ‘custom’ Unauthenticated group and assign it to the Browser Requestor.  We then saved the updated rule within a ruleset used by that group.   The rule still did not get picked up.  We were able to prove this by using the browser developer tools and looking at the HTML/CSS. 

So we are looking for suggestions on where this rule needs to be placed for it to get picked up.  At the moment I am suspecting that it may need to be saved into the Pega OOB rulesets.   If this is the case then my next question is if this change should be delivered via a HFIX as I do not think that we should be making changes manually to the OOB rulesets. 

A HFix is not in scope here. This rule is available to customize per your requirements. For example, this same page is exactly where companies would customize and add their own logos and color scheme, etc.

It sounds like it may not be setup properly. If you have a team responsible for [custom] authentication they are usually well versed in setting this part up as most of the rules would be saved under the same context for this purpose as well.