create policy for AllowRemoteRPC

[Kirk Groome]

we are trying to add a group policy to edit the key
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AllowRemoteRPC

Here is a copy of the ADM we are using now.

CLASS MACHINE
CATEGORY "system"
CATEGORY "test"
KEYNAME "SYSTEM\CurrentControlSet\Control\Terminal Server"
POLICY "Allow test"

ACTIONLISTON
VALUENAME "AllowRemoteRPC" VALUE NUMERIC 1
END ACTIONLISTON
ACTIONLISTOFF
VALUENAME "AllowRemoteRPC" VALUE NUMERIC 0
END ACTIONLISTOFF
END POLICY

End Category
End Category

We have tried changing the category names and we can get categorys to show
up but there is no policy in the category.
If we change the key to HKLM\software\policies\microsoft\windows
nt\terminal server key work when we tried to use that one. any ideas what we
might be doing wrong and how to fix it?

Thanks
Kirk Groome

[Florian Frommherz [MVP]]

Howdie Kirk!

Kirk Groome schrieb:

> we are trying to add a group policy to edit the key
> HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AllowRemoteRPC

Isn't there already a policy for this? How's
CompConf\AdmTempl\Windows Components\Terminal Services\ "Allow users to
connect remotely via Terminal Services" working?

> We have tried changing the category names and we can get categorys to show
> up but there is no policy in the category.
> If we change the key to HKLM\software\policies\microsoft\windows
> nt\terminal server key work when we tried to use that one. any ideas

When using your ADM template, right-click the category-name in Group
Policy Editor, choose View->Filtering and uncheck the boxes at the
bottom that say "Only show...".

This behavior is by design. The registry key you're trying to alter is
outside the four registry keys Microsoft considered "real" policies. You
actually wrote a "preference" with your ADM template, as it alters a
regkey outside those four reg branches:

HKEY_LOCAL_MACHINE\Software\Policies
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

ADM templates that alter those four branches above are called "policy".
They're shown by default - preferences are not. This all has to with the
behavior of the four branches above. They get switched back to their
default value when a policy not applies any more. "Preferences",
branches outside those four keys will stick with the value you last set
- even after you deleted your preference.

You can find a pretty damn good explanation about this whole thing on
Darren's site:

http://www.gpoguy.com/FAQs/tattoo.htm

cheers,

Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.