Change specific registry settings with Group Policy

jonasber...@hotmail.com

unread,

Nov 8, 2005, 2:52:53 AM11/8/05

to

If I want to change the registry with a GPO and it's not a "standard" policy
(administrative templates), then I have to make my own administrative
template, is that right ? Or is there another way ?
If it's right, should I make an own administrative template for every own
registry change ?

Please help me out.

Sincerely

\\Jonas B

Chamber

unread,

Nov 8, 2005, 10:35:13 AM11/8/05

to

If you want the registry setting to be persistent, then you will need to
create a custom template. I have done it using the following document
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/management/gp/admtgp.mspx,
although it still doesn't make it very easy. If find other documentation,
please post a link.
--
Chamber

Steven L Umbach

unread,

Nov 8, 2005, 2:34:20 PM11/8/05

to

This link might be easier to understand. It was for me for the more simple
settings that are either enabled or disabled.

http://thelazyadmin.com/index.php?/archives/125-Creating-Custom-ADM-Templates.html

To the original poster - you do not need to create a custom template for
every registry setting. Below is a simple .adm template with multiple
settings using the same keyname. The explain line is optional and is what
will show in the explanation box when you configure the setting. The policy
name is the name for the setting that you will see under the category while
the category is the name you will see under administrative templates after
you unckeck the option for show only policies that can be fully managed in
the filtering option of view when you have administrative templates
highlighted. --- Steve

CLASS USER

CATEGORY "Explorer file display options"
KEYNAME "Software\Microsoft\windows\currentversion\explorer\advanced"

POLICY "Allow vieweing hidden files and folders via Explorer"
EXPLAIN "Allow viewing of hidden files and folders in Explorer"
VALUENAME "hidden"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 2
END POLICY

POLICY "Allow access system files/folder via Explorer"
EXPLAIN "Show system files in Explorer"
VALUENAME "Showsuperhidden"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY "Allow display file extensions via Explorer"
EXPLAIN "Show file extensions known file types in Explorer"
VALUENAME "HideFileExt"
VALUEON NUMERIC 0
VALUEOFF NUMERIC 1
END POLICY

POLICY "Display contents of system folders via Explorer"
EXPLAIN "Allow display of contents of system folders in Explorer"
VALUENAME "WebViewBarricade"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

END CATEGORY

"Chamber" <Cha...@discussions.microsoft.com> wrote in message
news:90B42A9D-231F-4429...@microsoft.com...

Chamber

unread,

Nov 8, 2005, 2:48:21 PM11/8/05

to

Yes, I apologize for not making that clear in my posting. It does make that
somewhat apparent in the document I used. I created one with multiple just
as you show below. Thanks for clarifying and thanks for the new link!
--
Chamber

JB

unread,

Nov 9, 2005, 9:29:02 PM11/9/05

to

I have one that I do NOT want to persist when my users are off the domain. We
use a proxy server on campus, but the teachers' laptops are holding the
ProxEnable setting when at home. How do I stop THAT one?

Steven L Umbach

unread,

Nov 9, 2005, 11:12:30 PM11/9/05

to

You would have to create a local user account for them to logon to. If they
logon to their computer with cached domain credentials then Group Policy
settings will still apply. --- Steve

"JB" <J...@discussions.microsoft.com> wrote in message
news:E3F7B44C-3CE3-4449...@microsoft.com...

JB

unread,

Nov 10, 2005, 6:42:03 AM11/10/05

to

Hmmmmm......anyway to stop the caching of doman credentials?

Chamber

unread,

Nov 10, 2005, 7:48:06 AM11/10/05

to

Maybe you could put an icon on their desktop that could toggle the setting?
Just a thought.
--
Chamber

JB

unread,

Nov 10, 2005, 8:20:02 AM11/10/05

to

Interesting......how would I do that for a reg key to go from "0" to "1"?

Chamber

unread,

Nov 10, 2005, 8:49:15 AM11/10/05

to

There are quite a few different ways to script this. You could use the
reg.exe command - goto a command prompt and type in reg to check out the
syntax. Since you would want to read the value first and then toggle it,
another scripting language might be easier - .vbs maybe or AutoIT works
really well http://www.autoitscript.com/autoit3/
--
Chamber

JB

unread,

Nov 10, 2005, 9:01:01 AM11/10/05

to

Great, thanks!

Steven L Umbach

unread,

Nov 10, 2005, 12:35:35 PM11/10/05

to

Sure you can disable caching of domain credentials but many organizations
force users to use it to maintain GP settings when the user is not connected
to the domain. If you disable it the user could only logon via a local user
account anyhow. --- Steve

"JB" <J...@discussions.microsoft.com> wrote in message

news:80C11DB5-66DD-410C...@microsoft.com...

Steven L Umbach

unread,

Nov 10, 2005, 12:52:02 PM11/10/05

to

That sounds like a cool idea to try but the problem is that the user has
only read permissions to the keys that maintain most [administrative
templates] GP settings [ HKCU_software_policies] which override any like
settings the user can modify in the registry. However since GP IE
maintenance is not controlled by an administrative template it should work
in this case. The proxy setting is controlled via the
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ProxyServer: and as you said you could create two .reg files for
the user to choose from. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;310516 ---
crearing and using .reg files.

"Chamber" <Cha...@discussions.microsoft.com> wrote in message

news:E1D652BF-4EEB-4A82...@microsoft.com...