GPO Registry Preferences

[DAZZD88]

Do the preferences you can set in side the 2008r2 GPOs apply to XP clients? If not then my query is solved, if they do then please read on.

 

I have set preferences in different GPOs for registry settings to be updated depending on which OU in the tree the machine is. So I could have an OU called BASE with another OU inside called SUB. The settings for BASE should apply a registry setting change, then the settings for SUB should apply a change to the same key overwriting the previous change because of the order of policy inheritance.

 

I can't see any issues on the client machine in question using GPRESULT (see attached) and there are no problems in RSOP. Whenever I do a group policy modeling wizard query I get an event (see attached).

 

Any help would be greatly appreciated.

event.txt

gpresult.txt

[DMcCoy]

Only if you have the client side extensions installed on XP http://www.microsoft.com/downloads/details.aspx?FamilyID=e60b5c8f-d7dc-4b27-a261-247ce3f6c4f8&displaylang=en

[DAZZD88]

I still get the attached error from GP modelling wizard on the server.

[AngryTechnician]

I've seen error 0xc0000005 (Access violation) before when configuring certain preferences with filters. Take a look at my blog entry here and see if the situation I was in applies to you, or is similar at all: Group Policy Preferences: still useful, still pants

[DAZZD88]

I'm not entirely sure it does. In your blog you're using a Windows 7 client and I'm using an XP client and also a different part of the preferences section in GPMC, which I'm not familiar with at all. In the registry setting I have changed, the common tab in properties displays (see attached). So as far as I'm aware the registry change should be applied as the System account...I may have missed the point you were trying to make though.

[DMcCoy]

What part of the registry are you trying to change, HKLM or HKCU?

[AngryTechnician]

In the registry setting I have changed, the common tab in properties displays (see attached). So as far as I'm aware the registry change should be applied as the System account.

Correct, using those settings the preference should be applied using the SYSTEM account. You're not using any item-level targeting, which is what the error I saw as caused by.

[DAZZD88]

What part of the registry are you trying to change, HKLM or HKCU?

 

Local machine. The value in particular is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\Start and I want to change the value between either 3 or 4 to either set the service to automatic (started) or disabled. See attached for screenshot.

[DMcCoy]

Does it actually work on the machine? The GPMC is broken in several ways and will have an error even if there is nothing wrong with a policy.

[DAZZD88]

I've just tried and it would appear to work. D'oh!! I didn't think that the GPMC would be "broken". I've also realised I haven't quite planned the policy properly so it doesn't do exactly what I want but that's just a matter of tweaking it. Thanks guys.

[DAZZD88]

UPDATE: Okay, here goes...

 

I have gotten to the stage whereby the default setting for users for the removable storage service is disabled. I have also created a policy that enables the service for selected OUs. This bit works fine but the bit that doesn't is that whenever an administrator logs onto the machine, the Start key in the registry is deleted. Even with my policy that enables removable storage linked into the administrators OU, the administrator account still has this key deleted, yet another user account in this OU (my own account) the key appears and is the correct value.

 

I'm totally baffled by this now. Any help troubleshooting this or explaining this will be greatly appreciated.