Deploying Custom Registry Changes through Group Policy
Hi, Ned here. I’m a Technical Lead in Directory Services out of Charlotte, NC. Today I’m going to talk a little bit about a common customer question: how do I leverage group policy to deploy custom registry settings? I’ll be showing two ways to do this… the easier versus the harder. Why would you ever want to do the harder? Read on!
The Scenario
You’re administering thousands of Vista workstations and their applications, and you spend a lot of your day connecting to them for troubleshooting and maintenance. You’ve found that you’re using Windows Calculator all the time to convert hex to decimal and reverse; it’s the best way to search for error codes online after all. After the hundredth time that you’ve had to set the calculator from Standard to Scientific mode, you’ve decided to make it default to Scientific. So let’s learn about how to actually figure out where values get set, then how we can control them.
Figuring out the registry entry
It stands to reason that Vista’s Calculator has to store which mode it’s going to start in somewhere, and that this somewhere is probably the registry. So let’s download Process Monitor and use it for some light reverse engineering. We’re guessing that CALC.EXE will read and write the values, and that it will be registry related. So we start ProcMon.exe, then set a filter for a process of calc.exe and an operation of RegSetValue, like so:
We then start the calculator, and we switch it over to scientific mode. The filtered results are pretty short, and we see:
It’s doubtful the cryptography entries are anything but chaff, so let’s focus on this setting change for HKCU\Software\Calc\Layout. We right-click that line and choose ‘Jump to…’
This takes us into the registry editor, where we see what actually got changed. Pretty slick!
It looks like the DWORD value name ‘layout’ is our guy. We confirm by setting it to 1 and restarting calculator. It’s back to Standard mode. We restart calculator with the value set to 0 and now it’s Scientific again. So I think we’ve got what we need to do some group policy work.
The Easier Way
We’re just making a simple registry value change here, so why not use REGEDIT.EXE in silent mode to set it? To do this we:
1. Export this registry value to a file called SciCalc.reg
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Calc]
"layout"=dword:00000000
2. We create a new Group Policy object and link it to the OU we have configured for all the administrative users in the domain (ourselves and our super powerful colleagues).
3. We open it up and edit “User Configuration | Windows Settings | Scripts (Logon/Logoff) .
4. Under the Logon node, we add our settings so that regedit.exe calls our SciCalc.reg file silently (with the /s switch):
5. We click Show Files and drop our SciCalc.reg into SYSVOL.
6. Now we’re all set. After this policy replicates around the Domain Controllers and we logon to the various Vista workstations in the domain, Windows Calculator will always start in scientific mode. Neat.
The Harder Way
The logon script method is pretty down and dirty. While it works, it’s not very elegant. It also means that we have some settings that are done without really leveraging Group Policy’s registry editing extensions. It’s pretty opaque to other administrators as well, since all you can tell about a logon script applying is that it ran – not much else about if it was successful, what it was really doing, why it exists, etc. So what if we make a new custom ADM template file and apply it that way?
ADM files are the building blocks of registry-based policy customization. They use a controlled format to make changes. They can also be used to set boundaries of values – for the Calculator example there are only two possible good values: 0 or 1, as a DWORD (32-bit) value. Using an ADM lets us control what we can choose, and also gives good explanation of what we’re accomplishing. Plus it’s really cool.
So taking what we know from our registry work, let’s dissect an ADM file that will do the same thing:
<ADM Starts Here>
CLASS USER
CATEGORY Windows_Calculator_(CustomADM)
POLICY Mode
EXPLAIN !!CalcHelp
KEYNAME Software\Microsoft\Calc
PART !!Calc_Configure DROPDOWNLIST REQUIRED
VALUENAME "layout"
ITEMLIST
NAME !!Scientific VALUE NUMERIC 0 DEFAULT
NAME !!Standard VALUE NUMERIC 1
END ITEMLIST
END PART
END POLICY
END CATEGORY
[strings]
WindowsCalculatorCustomADM="Windows Calculator Settings"
Calc_Configure="Set the Windows Calculator to: "
Scientific="Scientific mode"
Standard="Standard mode"
; explains
CalcHelp="You can set the Windows Calculator's behavior to default to Scientific or Standard. Users can still change it but it will revert when group policy refreshes. This sample ADM was created by Ned Pyle, MSFT."
</ADM Ends Here>
· CLASS describes User versus Computer policy.
· CATEGORY describes the node we will see in the Group Policy Editor.
· POLICY describes what we see to actually edit.
· EXPLAIN describes where we can look up the ‘help’ for this policy.
· KEYNAME is the actual registry key structure we’re touching.
· PART is used if we have multiple settings to choose, and how they will be displayed
· VALUENAME is the registry value we’re editing
· NAME describes the friendly and literal data to be written
So here we have a policy setting which will be called “Windows_Calculator_(CustomADM)” that will expose one entry called ‘Mode’. Mode will be a dropdown that can be used to select Standard or Scientific. Pretty simple… so how do we get this working?
1. We save our settings as an ADM file.
2. We load up GPMC, then create and link our new policy to that Admins OU.
3. We open our new policy and under User Configuration we right-click Administrative Templates and select Add/Remove Administrative Templates.
4. We find our ADM and highlight it, then select Add. It will be copied into the policy in SYSVOL automagically.
5. Now we highlight Administrative Templates and select View | Filtering. Uncheck "Only show policy settings that can be fully managed" (i.e. any custom policy). It will look like this:
6. Now if we navigate to your policy, we get this (see the cool explanation too? No one can say they don’t know what this policy is about!):
7. If we drill into the Mode setting, we have this:
And you’re done. A bit more work, but pretty rewarding and certainly much easier for your colleagues to work with, especially if you have delegated out group policy administration to a staff of less experienced admins.
Notes
My little examples above with Calculator only work on Windows Vista and Windows Server 2008. Prior to those versions we used the WIN.INI to set calculator settings – D’oh! Now you have a very compelling reason to upgrade... ;-)
These sorts of custom policy settings are not managed like built-in group policies – this means that simply removing them does not remove their settings. If you want to back out their changes, you need to create a new policy that removes their settings directly.
ADMX’s can also be used on Vista/2008, but I’m saving those for a later posting as they make ADM’s look trivial.
This is just a taste of custom ADM file usage. If you want to get really into this, I highly suggest checking out:
Using Administrative Template Files with Registry-Based Group Policy - https://www.microsoft.com/downloads/details.aspx?familyid=e7d72fa1-62fe-4358-8360-8774ea8db847&displaylang=en
Administrative Template File Format - https://msdn2.microsoft.com/en-us/library/aa372405.aspx
- Ned Pyle
Comments
Anonymous
August 14, 2007
Very good read. Thanks! I have one question, though. Why are you using the old .adm format instead of the new admx/adml format? It's a bit more cumbersome to write by hand, but i would've loved to see some hands on by the exports on it...Anonymous
August 14, 2007
The comment has been removedAnonymous
August 14, 2007
Great article, read more... ...Anonymous
March 11, 2008
The comment has been removedAnonymous
November 19, 2008
We’ve been at this for over a year (since August 2007), with more than 100 posts (127 to be exact), soAnonymous
November 14, 2010
The comment has been removedAnonymous
November 15, 2010
Nope. GPP became a much better solution in the meantime and we wrote about that a lot.Anonymous
July 30, 2014
I worked on a Power Query Sign in issue recently that took a different spin from what I would have expectedAnonymous
August 11, 2014
Por ieblog
Como parte da nosso compromisso contínuo com a entrega de um navegador mais seguroAnonymous
August 11, 2014
Por ieblog
Como parte da nosso compromisso contínuo com a entrega de um navegador mais seguroAnonymous
September 17, 2014
Deploying Custom Registry Changes through Group Policy - Ask the Directory Services Team - Site Home - TechNet BlogsAnonymous
November 05, 2014
Deploying Custom Registry Changes through Group Policy - Ask the Directory Services Team - Site Home - TechNet BlogsAnonymous
November 08, 2014
Deploying Custom Registry Changes through Group Policy - Ask the Directory Services Team - Site Home - TechNet Blogs