Deploying a .reg file

[benjie]

Hi

 

I am wanting to deploy a .reg file to all the computers on our domain. The problem is that it alter keys in the current user hive. We have locked down our security by disabling registry editing. So I can not just deploy it via a simply log on script like the one below.

 

regedit /s file.reg

 

If you try deploying it as a log on script you get the following error message:"Registry editing has been disabled by your administrator". Does anyone know a way of getting round this? Using a .adm file is not easy, since I am adding a load of keys.

 

We are running:

Windows Server 2008 R2

Windows XP

 

Thanks

[sted]

i think it should work if you assign the script to users via gpo rather than as part of their logon script

 

so user config\windows settings\scripts\logon and add it there

[mounters]

As you have 2008R2 servers and if you have installed the Client Side Extension hotfix on the Windows XP PCs then you could do this as a user Group Policy Preference. Open a GPO (or create a new GPO) User Config -> Preferences -> Windows Settings -> Registry

[MYK-IT]

How about using the Registry section within Group Policy Preferences?

[benjie]

@sted:

i think it should work if you assign the script to users via gpo rather than as part of their logon script

 

so user config\windows settings\scripts\logon and add it there

 

Like I said originally if I use a log on script like you said, you get the following error message: "Registry editing has been disabled by your administrator".

 

@mounters: Which client side extension hot fix are you going on about?

 

@myk-it: That is not practical since I want to create a load of keys.

[Hightower]

@sted:

 

 

Like I said originally if I use a log on script like you said, you get the following error message: "Registry editing has been disabled by your administrator".

 

@mounters: Which client side extension hot fix are you going on about?

 

@myk-it: That is not practical since I want to create a load of keys.

 

What @sted; has suggested is different to why you are getting the error. Rather than write a script to insert the reg entry, just put the reg entry straight into the GPO and you should be fine.

[mounters]

Windows XP Client Side Extension update Download details: Group Policy Preference Client Side Extensions for Windows XP (KB943729)

 

CSE hotfix roll up Group Policy Preferences Client-Side Extension Hotfix Rollup

[sted]

What @sted; has suggested is different to why you are getting the error. Rather than write a script to insert the reg entry, just put the reg entry straight into the GPO and you should be fine.

 

no thats what i meant i though he had just added his line to say pupil.bat that a user gets when they login rather than a separate script

[e-class]

Two ways that I think you can get round this problem:

 

1)... Use and older version of reg.exe - cant remember which version, but can check when I'm back at work on Monday. This still allows users to run reg.exe even if registry editing is disabled.

 

or

 

2)... Use a .vbs script to change the reg keys you want.

 

HTH

[jsnetman]

As suggested using group policy preferences is the easiest, but deploying it through a logon script should still work if you set logon scripts to run with administrator priviledges even though registry changes for users are disabled. If this is not the case you could still deploy it by computer startup script and and deploy the reg file to HKEY_USERS/.DEFAULT portion of the registry which exists before a user logs on. That portion will be merged with the HKEY_CURRENT_USER when a user logs on. Edited January 9, 2011 by jsnetman

[benjie]

@e-class

 

Hi did you find out which verision of regedit you use?

 

Thanks

 

Benjie

[e-class]

Benjie,

 

Apologies for not getting back to you yesterday but it was bit of a manic Monday this week in my land of Citrix woes!!!

 

Anyway, the version of reg.exe (not regedit.exe) we use is 5.1.2600.0 according to the version info on the exe, so try looking for that (maybe W2K version?) and using that.

 

The syntax for reg.exe is a bit different but should be pretty simple - hopefully it will do the trick for you.

 

HTH