Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

error message

33 views
Skip to first unread message

boba

unread,
May 19, 2008, 3:40:01 PM5/19/08
to
When users logon to the machine get error message: invalid root in registry
key "HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM" code 80070005 source
wshshell.regwrite. How do I fix this error. My logon script shows the
following

Set WSHShell = WScript.CreateObject("WScript.Shell")
'To Enable Remote DCOM in the computer
WshShell.RegWrite "HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM","Y","REG_SZ"
'To Set Authentication Level to Connect
WshShell.RegWrite
"HKLM\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel",2,"REG_DWORD"
'To Set Impersonation level to Impersonate
WshShell.RegWrite
"HKLM\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel",3,"REG_DWORD"

Richard Mueller [MVP]

unread,
May 19, 2008, 4:42:43 PM5/19/08
to
boba wrote:

Users normally do not have permission to write to HKLM. On Vista clients
even administrators ordinarily cannot write to HKLM in a logon script.

A Startup script is a better option, as it runs with System privileges on
the local computer (although this might not work on Vista clients).

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--


boba

unread,
May 19, 2008, 5:01:08 PM5/19/08
to
This logon script is on Domain Controller under Default Domain Policy under
User Configuration -> Script. Because of this script the users are getting
this error message.

boba

unread,
May 19, 2008, 5:51:01 PM5/19/08
to
I forgot to mention, it has code: 80070005 after the error message. Does it
mean I need to run updates on the server and that will fix the error? Last
time I see the updates run on one DC was March 2007 with Service pack 1 and
on the other DC with service pack 2 updates were run on May 2007.

Richard Mueller [MVP]

unread,
May 19, 2008, 5:51:48 PM5/19/08
to
That explains the error. Logon scripts run with the credentials of the user
and users generally do not have permission to write to HKLM. They should not
have this privilege, as then they can be tricked to run code that messes up
the registry.

You probably can make these changes using a Startup script. In a Group
Policy navigate to "Computer Configuration", "Windows Settings", "Scripts".
A startup script runs before there is any user. It has System privileges on
the local computer so it can write to HKLM.

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--

"boba" <bo...@discussions.microsoft.com> wrote in message
news:D8994E36-BD13-48B9...@microsoft.com...

0 new messages