Modifying (or overwriting) NTUSER.DAT registry keys for users' local profiles

[Garacesh]

Long story short, I've finally figured out our Office365 woes, and it's to do with a registry value held in NTUSER.DAT, presumably the key is also set in the default profile and is copied to each user when their profile gets created for the first time. So basically I need to either update, or overwrite, a couple of registry keys, as per this Microsoft page.

 

Things I have tried so far (and I'm also going to list the steps I took, just to make sure I'm not getting it wrong somewhere..)

 

Attempt 1:

Group Policy Management, create new policy.

 

User Configuration, Preferences, Windows Settings, Registry

New > Registry Item

Action: Replace

Hive: HKEY_CURRENT_USER

Key Path: Software\Microsoft\Office\15.0\Common\Internet

Value name: UseOnlineContent

Value type: REG_DWORD

Value data: 2

Base: Hexadecimal

(Same for the other 3 keys).

 

Didn't work.

 

Attempt 2:

Same thing, but in Computer Configuration instead.

 

Didn't work.

 

Attempt 3:

User Configuration, Policies, Windows Settings, Scripts (Logon/Logoff)

Logon

Add...

\\domain.local\netlogon\Office365UseOnlineContent.bat (Note, that space isn't there in the policy. EduGeek has put it there because the string is too long.)

REG ADD HKCU\Software\Microsoft\Office\15.0\Common\Internet /v UseOnlineContent /t REG_DWORD /d 2 /f
REG ADD HKCU\Software\Policies\Microsoft\Office\15.0\Common\Internet /v UseOnlineContent /t REG_DWORD /d 2 /f
REG ADD HKCU\Software\Microsoft\Office\15.0\Common\SignIn /v SignInOptions /t REG_DWORD /d 2 /f
REG ADD HKCU\Software\Policies\Microsoft\Office\15.0\Common\SignIn /v SignInOptions /t REG_DWORD /d 2 /f

 

Didn't work

 

Kinda stuck now.. Any ideas on how to achieve what I'm aiming for? Am I in the right ballpark, just mucking up syntax or something?

Edited December 17, 2015 by Garacesh

[Boredguy]

Are you copying a default NTUser.dat to users, or is it being dynamically created when they first log on?

 

If you copy one over, you can edit it via RegEdit.

[Garacesh]

First one. They have local profiles on the machine, not a mandatory profile. So I presume (from my limited knowledge of profiles, generated in the past week, from trying to get W10 working) that their local profile is generated from the Default User profile when they first log on.

 

To put it simpler, for staff accounts in AD, Profile tab, User Profile, Profile Path: is empty.

[Boredguy]

Ok, so local profile it is then.

Load Regedit, and in the HK_Users section, go to File -> Load Hive and pick your local NTUser.Dat from the default user.

Give the node a name (Default) and browse for the string you mentioned above.

Check the values and if they exist and are wrong, update it, then unload the hive and login with a new user and see what happens.

[Garacesh]

I've done the reg modifications and that works fine. (Did it with a test user rather than the default user, but same concept. Login, generate NTUSER.DAT (with the wrong/unmodified key), reboot, load hive, modify key, login, all works fine)

 

I could replace the default ntuser.dat with a new one, containing the modification, by using a robocopy script at startup. That would sort out all new user accounts created on the machine after the policy had applied. But everyone that's already logged onto the PC (meaning they have their own ntuser.dat already, which doesn't contain the modified key) wouldn't be affected by the change.

 

So my options are either 1) Delete every local profile on all 200+ machines B) Somehow update the local profiles site-wide or γ) Find a way to overwrite that registry key each logon.

 

Am I making sense?

[Boredguy]

Have you tried setting it via GPO instead of playing with the registry values?

 

User Config -> Policies -> Admin Templates -> MS Office 2013 -> Miscellaneous -> Block Signing into Office

Value is Org ID only

[Garacesh]

Yep, I've tried that, it doesn't appear to work either Still get "Blocked by your administrator."

[Arthur]

Didn't work.

For future reference this is how you would modify a default user profile using REG...

 

REG LOAD "HKLM\_CURRENTUSER" C:\Users\Default\NTUSER.DAT
REG ADD "HKLM\_CURRENTUSER\Software\Policies\Microsoft\Office\15.0\Common\Internet" /v UseOnlineContent /t REG_DWORD /d 2 /f
REG ADD "HKLM\_CURRENTUSER\Software\Policies\Microsoft\Office\15.0\Common\SignIn" /v SignInOptions /t REG_DWORD /d 2 /f
REG UNLOAD "HKLM\_CURRENTUSER"

 

You have to load the ntuser.dat into HKLM so HKCU becomes HKLM\SOMETHING_UNIQUE. In the example above I used _CURRENTUSER.

Edited December 17, 2015 by Arthur

[DJ-1701]

Yep, I've tried that, it doesn't appear to work either Still get "Blocked by your administrator."

 

Looking above, you're setting 4 regkeys? Two of which are the Group Policy enforced keys. The article states just the 2 need to be updated, which is logical as the Policy keys won't be set unless someone has set a policy or deliberately set the key manually.

 

Article Info:

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Internet\UseOnlineContent

With a value of 2

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\SignIn\SignInOptions

With a value of 0

 

Looking at your first post you have set all of the registry entries to 2, which is different to the webpage suggestion... is that on purpose?

Edited December 17, 2015 by DJ-1701

[Garacesh]

Sorry, @Arthur, thanks for that, but a little bit confused.

That would modify the default profile NTUSER.DAT, not the currently existing ones for actual users, right?

So any further logins would have the new setting, but the old ones wouldn't?

 

Edit:

Looking at your first post you have set all of the registry entries to 2, which is different to the webpage suggestion... is that on purpose?

Yes.

UseOnlineContent 2 = "Allow people to sign in to Office 365 through Microsoft Office 2013 programs."

SignInOptions 2 = "Only allow them to use the organisation name, i.e. [email protected], rather than [email protected]"

(0 = Any, 1 = OnMicrosoft.com only, 2 = Organisation only, 3 = Not allowed to use either.)

 

We want to effectively ignore "onmicrosoft" emails so people don't know they exist. Otherwise it'll just cause too much confusion.

Edited December 17, 2015 by Garacesh

[Arthur]

That would modify the default profile NTUSER.DAT, not the currently existing ones for actual users, right?

 

So any further logins would have the new setting, but the old ones wouldn't?

Correct. I should have mentioned that.

[Rob_D]

So my options are either 1) Delete every local profile on all 200+ machines B) Somehow update the local profiles site-wide or γ) Find a way to overwrite that registry key each logon.

 

Am I making sense?

 

 

If your only problem with blowing away all the local user profiles is the amount of work why not use delprof to do it remotely? Just have a big script with all your PC names in, or even put it in shutdown/startup scripts temporarily while you reboot the PCs.

Edited December 17, 2015 by Rob_D
Because I'm a fool

[Garacesh]

@Rob_D it's just ridiculously impractical. If I make a GPO that removes profiles, it will continuously remove profiles all the time (because it'll have to remain active for at least a month to ensure it's caught every computer, you know what staff are like for shutting down), during which time logons will take longer (generating a new profile every time) and changes won't be saved (as profile gets deleted), which is why I was banking on some kind of logon policy that would overwrite or take precedence over the users local NTUSER.DAT. It can be done, sure, but if there are other options I'd rather avoid it.

 

Edit: I guess I could put some kind of datetime parameter in, perhaps..? Keep the new ones? Hmm.

 

We did have roaming profiles a while back, which would be an easier fix, but we had a huge spate where problems would develop and end up following them around the building and breaking more and more machines, so we moved back to local for staff and mandatory for the kids.

[Rob_D]

No remote shutdown? Fair enough.

 

What about just a single script with all the PC names in (you could export this from AD), that you schedule to run at midnight or some time when no-one's logged on. Just ask everyone to leave their computers on. Just make sure the task is set to run with domain admin privileges.

 

c:\delprof2.exe /c:ComputerName1
c:\delprof2.exe /c:ComputerName2

And so on with a new line for each pc.

 

or if you wanted it in the startup/ shutdown script then something like this might work to make it only run once on each pc. Might not get 100% of profiles, but it would leave you with a more manageable number of broken ones.

 

IF NOT EXIST C:\delprofHasRun goto Delprof
:else
goto next

:delprof
c:\Delprof2 /u /i
mkdir C:\delprofHasRun
goto next

:next

[Boredguy]

@Rob_D it's just ridiculously impractical. If I make a GPO that removes profiles, it will continuously remove profiles all the time (because it'll have to remain active for at least a month to ensure it's caught every computer, you know what staff are like for shutting down), during which time logons will take longer (generating a new profile every time) and changes won't be saved (as profile gets deleted), which is why I was banking on some kind of logon policy that would overwrite or take precedence over the users local NTUSER.DAT. It can be done, sure, but if there are other options I'd rather avoid it.

 

Edit: I guess I could put some kind of datetime parameter in, perhaps..? Keep the new ones? Hmm.

 

We did have roaming profiles a while back, which would be an easier fix, but we had a huge spate where problems would develop and end up following them around the building and breaking more and more machines, so we moved back to local for staff and mandatory for the kids.

We delete all profile at logoff cause we're mean. All our staff have roaming profiles, and the students have mandatory ones. All users have appdata etc redirected and *touch wood* we've had no issue.

 

Strange that it is not applying the settings via GPO.

[Garacesh]

Hm. Also a valid point. I'm reluctant to strike out users' saved settings (stored passwords, internet favourites, program settings such as any modifications to Office etc.. Outlook being a massive one that's going to bite me in the ass if I do this..) but I am considering it. I'll end up taking a lot of flak for it though, even though I'm getting begged left, right and centre to get 365 working.

[Boredguy]

Something to look at.

Logon to a workstation with an effected user

On another station, load regedit and connect to that station

Check the users hive for the current user (play guess the ssid) and see if it has the registry values.

 

If not, manually add it, then launch office and see if it's behaving.

 

[Edit]It is nicer to resolve the issue without wiping out all there settings I know[/edit]

[Garacesh]

Hm. I didn't think you could modify a hive whilst it was in use? But I'll try that.

 

I modified an unloaded/not logged in hive to test it. The profile (which I checked did not exist before login, so was definitely created based upon the computers default profile) did not have HKCU\...\Policies\...\UseOnlineContent, nor either of the SignInOptions keys. It only had HKCU\Software\Microsoft\Office\15.0\Common\Internet UseOnlineContent (which was 00000000). If I modified that to a 2, unloaded the hive, logged back in on the machine (so everything else was identical except that one registry key) boom, it worked.

[Boredguy]

You don't need to load the hive.. the HKEY_USERS will have the entry for the current user. For example, my local regedit shows me as HKEY_USERS\S-1-5-21-2721052843-1016065945-3984182611-1006

 

You can switch the value and test it live... most times it saves the change when the user logs off as well.

[DJ-1701]

Btw, if you run the following PowerShell on computer bootup, it should update the registry entries for all profiles. Just give it a couple of minutes to process before logging in.

If you remove -or ($Folder -eq "Default") it should even update the Default user profile if you want.

 

$LocalProfileDir = "C:\Users\"
$ListOfFolders = Get-ChildItem $LocalProfileDir -Force | Where-Object {$_.PSIsContainer} | % { $_.Name }
# Check if Array is Null (Prevents ForEach null bug in PowerShell 2).
If ($ListOfFolders -ne $null)
{
   # Do the following for every folder we scanned.
   FOREACH ($Folder in $ListOfFolders)
   {
       If (!(($Folder -like "Administrator*") -or ($Folder -eq "All Users") -or ($Folder -eq "Default") -or `
       ($Folder -eq "Default User") -or ($Folder -eq "LocalService") -or ($Folder -eq "Public")))
       {
           Write-Host "Updating... $Folder"
           REG LOAD "HKLM\UserProfile" $LocalProfileDir$Folder\NTUSER.DAT
           REG ADD "HKLM\UserProfile\Software\Microsoft\Office\15.0\Common\Internet" /v UseOnlineContent /t REG_DWORD /d 2 /f
           REG ADD "HKLM\UserProfile\Software\Microsoft\Office\15.0\Common\SignIn" /v SignInOptions /t REG_DWORD /d 2 /f
           REG ADD "HKLM\UserProfile\Software\Policies\Microsoft\Office\15.0\Common\Internet" /v UseOnlineContent /t REG_DWORD /d 2 /f
           REG ADD "HKLM\UserProfile\Software\Policies\Microsoft\Office\15.0\Common\SignIn" /v SignInOptions /t REG_DWORD /d 2 /f
           REG UNLOAD "HKLM\UserProfile"
       }
   }
}

Edited December 17, 2015 by DJ-1701

[Garacesh]

Hm, that certainly looks like it could be useful.

When you say "give it a couple of minutes to process before logging in", I thought that startup scripts wouldn't allow logon (i.e. not get to CTRL+ALT+DEL) until the startup scripts had finished being processed?

[DJ-1701]

Hm, that certainly looks like it could be useful.

When you say "give it a couple of minutes to process before logging in", I thought that startup scripts wouldn't allow logon (i.e. not get to CTRL+ALT+DEL) until the startup scripts had finished being processed?

 

Say that in the same way as Microsoft warn you about editing the Registry . Unless you have changed the environment not to wait for scripts or have reached the timeout (both rare I know) it shouldn't need the time no, it's just in case .

[kdc]

I found this, which will enumerate every ntuser.dat, load into HKLM and add keys, then unload...My reccomendation is to comment out all the delete, binary, hex key options to avoid script errors.

 

https://micksmix.wordpress.com/2012/01/13/update-a-registry-key-for-all-users-on-a-system/