Registry GPO

[GRitchie]

Hello,

Anyone know how to set a group policy to allow editing to HKCU?

 

I've got a powershell script that all the staff have to run and it adds multiple keys however they don't have the permission!

 

If I have to enable full registry editing, I'm okay with that as most won't understand it to be able to edit it anyway.

[Domino]

Could you not add the keys using group policy preferences? effectively removing the need for staff to do so? Or run the powershell as a login script?

[GRitchie]

Is it as simple to do that way?

I did see this as an option!

 

If ran on startup, will this run with administrative privileges and if so will this apply for ALL users?

[Domino]

Have a read here: https://4sysops.com/archives/configuring-logon-powershell-scripts-with-group-policy/

 

targeting at user level will run it for the users in an OU on any domain machine they login to, targeting at a machine OU will apply on all users logging in to those machines - so depends on your needs. You can also do fancy things with item-level targeting in GPP if more granularity is needed.

 

Personally I'd recommend doing it with GPP registry addins (for example)> Using GPOs to Set Custom Registry Entries (great for Virtual Desktops) Example: Disabling the Machine Password Changes -I've always found them far more reliable and easy trackable than scripting changes.

[Oaktech]

or use the GPO to run setACL to give temporary write access...

 

https://helgeklein.com/setacl/

[GRitchie]

Can you add a new key with this? Not just DWORDS etc.

[Arthur]

Group Policy Preferences would definitely be the way to go (as @Domino mentioned).

 

Can you add a new key with this? Not just DWORDS etc.

You can add/delete any type of registry value or key with GPP.

Edited January 5, 2015 by Arthur

[Oaktech]

Can you add a new key with this? Not just DWORDS etc.

 

Yeah, you can manipulate the registry at will with set acl. It's fiddly, but it's powerful.