GRitchie Posted January 5, 2015 Posted January 5, 2015 Hello, Anyone know how to set a group policy to allow editing to HKCU? I've got a powershell script that all the staff have to run and it adds multiple keys however they don't have the permission! If I have to enable full registry editing, I'm okay with that as most won't understand it to be able to edit it anyway.
Domino Posted January 5, 2015 Posted January 5, 2015 Could you not add the keys using group policy preferences? effectively removing the need for staff to do so? Or run the powershell as a login script?
GRitchie Posted January 5, 2015 Author Posted January 5, 2015 Is it as simple to do that way? I did see this as an option! If ran on startup, will this run with administrative privileges and if so will this apply for ALL users?
Domino Posted January 5, 2015 Posted January 5, 2015 Have a read here: https://4sysops.com/archives/configuring-logon-powershell-scripts-with-group-policy/ targeting at user level will run it for the users in an OU on any domain machine they login to, targeting at a machine OU will apply on all users logging in to those machines - so depends on your needs. You can also do fancy things with item-level targeting in GPP if more granularity is needed. Personally I'd recommend doing it with GPP registry addins (for example)> Using GPOs to Set Custom Registry Entries (great for Virtual Desktops) Example: Disabling the Machine Password Changes -I've always found them far more reliable and easy trackable than scripting changes. 1
Oaktech Posted January 5, 2015 Posted January 5, 2015 or use the GPO to run setACL to give temporary write access... https://helgeklein.com/setacl/
GRitchie Posted January 5, 2015 Author Posted January 5, 2015 Can you add a new key with this? Not just DWORDS etc.
Arthur Posted January 5, 2015 Posted January 5, 2015 (edited) Group Policy Preferences would definitely be the way to go (as @Domino mentioned). Can you add a new key with this? Not just DWORDS etc. You can add/delete any type of registry value or key with GPP. Edited January 5, 2015 by Arthur
Oaktech Posted January 5, 2015 Posted January 5, 2015 Can you add a new key with this? Not just DWORDS etc. Yeah, you can manipulate the registry at will with set acl. It's fiddly, but it's powerful.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now