GPEdit.MSC – Doesn’t show changes made to the registry?

GPEdit.MSC – Doesn’t show changes made to the registry?

That’s a question that came up a couple of times in the past, so I thought I’d write a few words about it. The question is:

“When I make changes to the registry that correspond to a Group Policy Setting, why doesn’t show GPEdit.msc (the GPEditor) the changed setting?”

That is due to how Windows applies GP settings to the registry.

What GPEdit writes and reads is not the registry directly but a intermediate file, called the Registry.POL. The POL file stores the changes and registry values that get incorporated by the Registry CSE (well, there’s some involvement with the ntuser.dat but that’s a different story). The point is that GPEdit reads/writes Registry.POL and the CSE is using that Registry.POL file to read the registry configuration off the the file to put it into the registry.

When making changes to the registry, the Registry CSE doesn’t care about the current state of the registry keys and values it changes – it just applies the settings governed by the POL file. In fact, it does wipe all values in the “four” special POLICY-hives and re-creates them according to the POL file. So – changes you make to the Registry are not carried out back to the POL file and therefore, GPEdit won’t look find them there.

What you will always see in GPEdit is what is configured in the Registry.POL file.

Advertisements

Finding that specific Group Policy Setting

Have you found yourself searching for the right place whenever your in a stituation where you need a specific Windows setting, an Office behavior or a third party application – and you want to control that with Group Policy?  How do you know if there’s a GPO for what you need and where it’s located?

Well, there are a couple of steps you can use.

Check whether there’s a built-in GPO

Your first step probably is to check if there’s a ready-to-go GPO you can deploy. For that, you can fire up GPMC and check there. But other than browsing through the GPEditor tree or using the GPMC search, there are other two additional options. Those are good when you are with a customer and can’t get your hands on a machine with GPMC loaded. The first option is one of the coolest Azure apps I’ve seen: http://gps.cloudapp.net. GPS stands for Group Policy Search – you can search for GPOs by name or browse the GPO tree “virtually”. You can get it from any machine with internet access. If you’re more the download-n-go kind of guy, someone who sticks with references, there’s a GPO reference Excel spreadsheet: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fb&displaylang=en. They contain the setting names, the registry location the settings change, the path to browse and the “supported on” information. All searchable – and filterable, excel-like. That should get you going.

By now, you should know if there’s a built-in GPO you can use. In case you found what you were searched, consider yourself done with this article. If not, read on.

Check whether there’s a custom ADM(X) template

So no luck with the built-in stuff. Good thing there’s the community and fine places you can find and download ADM(X) templates from. ADM(X) templates are simply templates you can add to Group Policy Editor – based on the information in the template, the correct registry settings are forced on the client. Reading this, you probably noticed that this only works for registry settings, so it’ll only add “Administrative Templates” settings. There are ADM template files for pre-Vista GPMC administrators and ADMX template files for Vista+ GPMC administrators. Vista+ GPMC understands ADM, too, but XP’s GPMC only eats ADM template files. So be sure to search and find for the correct format.

For Microsoft Office, there are downloadable ADM(X) template files around: http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=92d8519a-e143-4aee-8f7a-e4bbaeba13e7 and http://www.microsoft.com/downloads/en/details.aspx?FamilyID=64b837b6-0aa0-4c07-bc34-bec3990a7956&displaylang=en. No biggie to find them. ADM templates can be imported in GP Editor by clicking the “Administrative Templates” node and choosing “Add/Remove template”. For ADMX, you’ll have to either copy the files to the CentralStore or to the local PolicyDefinitions folder and re-open the GPEditor. It appears that I have created a link list for ADM template files in the past: http://www.frickelsoft.net/blog/?p=38, you may find other ADM template using Bing or Google or any other search engine. If you’re familiar with German, at least a bit, you can check Mark Heitbrink’s Group Policy site in German. He has a ton of ADM template files you can download and adjust: http://www.gruppenrichtlinien.de/index.html?/adm/Beispiele.htm. #24 for Adobe Reader is a real pearl 🙂 Also, I’ve found http://www.appdeploy.com has some good tips for you. They not only have tips and tricks about zero-touch installations, unattended installer packages and script installations, I’ve seen a couple of good ADM templates there. Worth a try!

Tracing the software setting’s steps

Still not lucky? Okay, time to get our hands dirty. When you change a setting, close the application and re-open it, the setting needs to get stored somewhere. Pretty likely that’s some place in the registry or some ugly .ini file. You only need to find where. There are tools that help you with that. Regshot is one of these great tools for free. You create a “before” snapshot of the registry, then open your app, change the setting, close it and make a “after” snapshot. You then compare the two and find the changes the software setting obviously had to make: http://sourceforge.net/projects/regshot/. There are other tools out there. Process Monitor (formerly FileMon and Regmon) is a great tool that helps you trace file and registry operations and filter for applications: http://technet.microsoft.com/en-us/sysinternals/bb795533.

Once you’ve found the location and the values a switch flip in your application changes, you’ll just have to deploy them via Group Policy. There are numerous ways – but today, you don’t want to use most them anymore. For a registry change, you can

(1) Write a custom ADM template file and import it: https://gandalf50.wordpress.com/2011/09/09/modifying-the-office-2010-adm-templates-to-allow-more-trusted-locations/
(2) Create a registry export on a sample machine and import it via a script: “regedit.exe /s myReg.reg”
(3) Use GP Preferences Registry settings to deploy the changes all at once!

Clearly, option 3 is the way to go. Creating custom ADM templates is… well, not too easy. Scripting is … yeah, so 1990.

How to Add AD user accounts or groups into the local Administrators group with GPO

How to use Restricted Groups?

( – or: How to Add AD user accounts or groups into the local Administrators group with GPO)

This article describes the feature “Restricted Groups” in Group Policy. This feature enables you – as the administrator – to configure group memberships on the client computers or member servers. You can add user accounts to groups on client machines that are in the scope of the policy.

As there are many questions about this in the newsgroups, I will come up with an example that shows how to put a group of Active Directory users into the local Administrators group on the clients.

For this article, I assume that you already created a global security group containing all users that shall become local Administrators on some client computers. In my example, the group is called “localAdmins”. The target (= client) computers reside in a specific OU.

If you’re using the Group Policy Editor, you navigate to the OU where the client computers reside and right-click it. Choose “Properties” and “Group Policy” where you create a new Policy and click “Edit”. You then navigate to:

Computer Configuration\Windows Settings\Security Settings\ and then right-click “Restricted Groups” and choose “Add Group”.

You simply add the created group by clicking “Browse..” or typing the group name into the box.

After clicking “OK”, another  window opens up, where you can find two boxes. The upper box, saying “Members of this group”, the lower one saying “This group is a member of”. In my case above I am adding a group called TechSupport.

If you added users or groups into the “Members of this group” box, you would advise the Restricted Groups feature to put the users and groups you selected into the localAdmins group. Restricted Groups would then replace the current members of the localAdmins group with the users and groups you filled into the box. Please understand that it replace them by wipeing existing users out of the local Admins group.

Since we do not want to add users or other groups to our existing group, but instead want to add a new  group to the local Administrators group on all of our clients, we have a look at the lower box – labeled “This group is member of”. We click “Add” and type in the name of the group that  we want  added to the localAdmins on each client. In this case, it’s “Administrators”. We then simply click “OK” and “Apply” and close all windows. “This group is member of” advices “Restricted Groups” to add our localAdmins group into the “Administrators” group of the clients. The existing group members will not be touched – it simply adds in this case  the TechSupport group to every clients local administrators group.

Adding the admx files from Office 2010 admin templates into your GPMC

I had to add some Outlook 2010 specific GPO’s this week and found the instructions available on the net weren’t quite adequate. So I thought I would explain the procedure I took to get it done.

First off, you will need to download the admin template files Get them here

The 32bit and 64bit admx files are identical.  You only need the different versions if you are using the Office Customization Tool (OCT)

The downloaded file is a self-extracting file. Just launch it and extract the file to a folder. Inside that folder will be an admx folder and the corresponding language files (in their own folders). There will also be an adm folder (these are the older style adm template files) and a admin folder (which you only need if your using OCT and don’t have the enterprise office install)

Now go to the folder C:\windows\syvol\domain\policies

Create a folder inside of policies folder called policydefinitions  and copy all the files from the admx folder that was created  from the extraction  and any language file folders you may need. The complete folder path will be C:\windows\syvol\domain\policies\policydefinitions 

In my case I added all the office admx files and only the corresponding English languages.

admx locations

Close your group policy console if open and re-open it. As shown below, all of the Office 2010 admx template files will now show up under Administrative templates since it is retrieving them automatically from the central store.

policy

In this particular case I was adding a GPO to automatically check user spelling before sending emails.

spelling rule

That’s It. Now that wasn’t too difficult after all