I'm stuck !! Group Policy Registry Keys

[mattx]

dumped it where ?

 

On my desk. [ Mac Book - one of those stupid thin ones ]

[box_l]

Changing Reg permissions

 

subinacl.exe /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib /GRANT=domain\user=F

 

or

subinacl.exe /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib /GRANT=domain\group=F

 

The "F" grants full.

 

You'll find examples in sims.bat (if you have SIMS)

 

BoX

[link470]

I'm trying your suggestion BoX, using that tool, and I'm getting error 1337 [lol] The security ID structure is invalid. The software I'm trying to edit is by a company called Kuta software and I'm trying to modify a key to make it writable of course.

 

Here's the batch file:

 

regedit /s %logonserver%\netlogon\KUTA.reg

%logonserver%\netlogon\subinacl.exe /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Kuta Software\Auth /GRANT=MY_DOMAIN\Users=F

 

This outputs the following:

 

>regedit /s %logonserver%\netlogon\KUTA.reg

 

>%logonserver%\netlogon\subinacl.exe /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Kuta Software\Auth /GRANT=MY_DOMAIN\Users=F

LookupAccountName : HKEY_LOCAL_MACHINE\SOFTWARE\Kuta:MY_DOMAIN\users 1337 The security ID structure is invalid.

 

Current object HKEY_LOCAL_MACHINE\SOFTWARE\Kuta will not be processed

 

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax errors 1 Last Syntax Error:WARNING : /grant=MY_DOMAIN\users=f : Error when checking arguments - HKEY_LOCAL_MACHINE\SOFTWARE\Kuta

 

 

::EDIT::

 

I tried adding quotes around HKEY_LOCAL_MACHINE\SOFTWARE\Kuta Software\Auth making the command:

 

%logonserver%\netlogon\subinacl.exe /KEYREG "HKEY_LOCAL_MACHINE\SOFTWARE\Kuta Software\Auth" /GRANT=MY_DOMAIN\Users=F

 

Still no luck.

Edited February 15, 2010 by link470

[box_l]

I get the same results "1337" with local groups "users" and "administrators", however when i created a test group "test" it worked!?

 

try...

 

SubInAcl.exe /KEYREG "HKEY_LOCAL_MACHINE\SOFTWARE\Kuta Software\Auth" /GRANT=Users=F

 

I think it has trouble with the builtin groups. It has the same issue locally.

 

I realise that you want this for your domain\users but domain users are local users as far as this goes.

 

BoX

[link470]

I think it has trouble with the builtin groups. It has the same issue locally.

 

Fantastic, thanks! That worked Only thing now, and it's not huge, I can edit the few entries below it, but is there a way I can use this exe to place the Users=F permissions down to propagate to internal entries? If not, I THINK I can work without it. Just thought I'd ask while I can.

[box_l]

/subkeyreg 

 

? not tested though

 

or create key,

change permissions,

create values. inhereited permissions?

 

BoX

[link470]

Sounds good, thanks! I'll give that a shot. Now here's a question of security. Does leaving subinacl in your netlogon folder pose a security risk if say, a skilled user [and this is highly unlikely, just thought I'd throw it out there as a huge IF] managed to open the netlogon folder, view the exe in there, know what it was for, and use it? The command line and registry are restricted, as well as running your own bat and vbs scripts. I don't think it can be used in any way by a user to edit permissions. Would it even be able to run as a user? This is a startup script at the moment to make those changes.

[mac_shinobi]

Sounds good, thanks! I'll give that a shot. Now here's a question of security. Does leaving subinacl in your netlogon folder pose a security risk if say, a skilled user [and this is highly unlikely, just thought I'd throw it out there as a huge IF] managed to open the netlogon folder, view the exe in there, know what it was for, and use it? The command line and registry are restricted, as well as running your own bat and vbs scripts. I don't think it can be used in any way by a user to edit permissions. Would it even be able to run as a user? This is a startup script at the moment to make those changes.

 

Could you not create a folder in the netlogon folder and only give a specific user account and the system access rights to that folder so that when the script runs it and the one account are the only ones allowed to access or use any items in that folder ( the one account most likely being a domain admin )

 

Not sure if that would work if ntfs perms are being applied from above ??

 

Other then that I would create a hidden share where its located that all the computers can access but with strict ntfs perms

[sted]

Could you not create a folder in the netlogon folder and only give a specific user account and the system access rights to that folder so that when the script runs it and the one account are the only ones allowed to access or use any items in that folder ( the one account most likely being a domain admin )

 

Not sure if that would work if ntfs perms are being applied from above ??

 

Other then that I would create a hidden share where its located that all the computers can access but with strict ntfs perms

 

or just script copying it to the windows or other local dir thats pathed and locked down

[SYNACK]

Sounds good, thanks! I'll give that a shot. Now here's a question of security. Does leaving subinacl in your netlogon folder pose a security risk if say, a skilled user [and this is highly unlikely, just thought I'd throw it out there as a huge IF] managed to open the netlogon folder, view the exe in there, know what it was for, and use it? The command line and registry are restricted, as well as running your own bat and vbs scripts. I don't think it can be used in any way by a user to edit permissions. Would it even be able to run as a user? This is a startup script at the moment to make those changes.

 

This may not be an issue, the subinacl program should work in the user context that runs it, unless your users are administrators they should not be able to take ownership of files and so should not be able to alter the permissions. It may be a lower level tool that that so it is worth a test but it will probably be a non issue as windows is likely to prevent it.

[OverWorked]

Do what ZeroHour and HullFC have suggested. GP preferences aren't there by default in server 2003, but appear when you upgrade the schema for Vista and manage it from Vista. It's been a while since I did mine, so can't remember how it's done. Anyway when it's done it's a doddle to set registry values.

 

See this - it's actually simpler than it looks, and better than running .reg scripts.