Petri.com forums Home Forums Start Page Forums Frequently Asked Questions FAQ Member List Members List
Go Back   Petri IT Knowledgebase Forums > Microsoft Networking Services > GPO
Petri.com is happy to award RicklesP the title of Most Valuable Member !!!
Register Calendar Calendar Search Petri IT Knowledgebase Forums Search Todays Posts Today's Posts Mark Forums Read
Notices

permanantly remove policy restriction for the current user

permanantly remove policy restriction for the current user

this thread has 7 replies and has been viewed 9570 times

Closed Thread
 
Thread Tools Search this Thread Display Modes
  #1  
Old 7th February 2007, 23:29
skmrodgers skmrodgers is offline
Casual
Casual
 
 Join Date: Feb 2007
  6 month star 12 month star
 Posts: 4
 Reputation: skmrodgers is on a distinguished road (10)
Default permanantly remove policy restriction for the current user

is there a way to permanantly remove policy restriction on a pc? my issue is we have a GPO on our pc's here at work to not allow certain programs to be executed or run..(games, ex: sol, pinball, etc..) i have several laptops that i setup for our salesmen who are always on road and travel and they dont have to be in the restriction.. when they are at airports, hotels, etc..they are allowed to play..i was wondering if there was a way to remoave the GPO on there laptops without them having to bring them in to me.. they have admin rights on the laptop and i know the program here you can download kills the policy temporarily.. i want to disable it permanatly from the laptop without the need of them bringing the laptop back in.. they only come in once a year.. they all live nationwide.. can this be done? i figure if it can be done temp it can be done perm? thanks steve
  #2  
Old 7th February 2007, 23:40
rvalstar's Avatar
rvalstar rvalstar is offline
Senior Member
Guru
 
 Join Date: Oct 2006
  6 month star 12 month star
 Location: Houston, TX
 Posts: 1,303
 Reputation: rvalstar is just really nicervalstar is just really nicervalstar is just really nicervalstar is just really nice (376)
Default Re: permanantly remove policy restriction for the current user

I think you can accomplish this by denying access to registry.pol as JeremyW suggests for a different issue in this thread:

http://forums.petri.com/showthread.p...0948#post50948

Let us know if you need more info / how it works out.

Thanks Jeremy
__________________
Cheers,

Rick

** Remember to give credit where credit is due and leave reputation points Click on that post's Yin-Yang icon where appropriate **

2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.
  #3  
Old 8th February 2007, 00:49
skmrodgers skmrodgers is offline
Casual
Casual
 
 Join Date: Feb 2007
  6 month star 12 month star
 Posts: 4
 Reputation: skmrodgers is on a distinguished road (10)
Default Re: permanantly remove policy restriction for the current user

i figured out another way in case anybody wants to know what i did.. i went into the registry and searched and found where the policy is that restricts the games being played.. it is in the:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer\DisallowRun]

so from here i figured i would write a script that would remove the entries so that i could send this file to all the salesmen on the road and they would not have to worry about editing the registry themselves..(this could be dangerous) and of course please export your registry in case of anything going wrong before you ever edit the registry.. but here is the script i wrote and it worked to perfection. everything is working perfectly and i have found no issues of anything else not working properly.. :


[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer\DisallowRun]
"1"=-
"2"=-
"3"=-
"4"=-
"5"=-
"6"=-
"7"=-
"8"=-
"9"=-
"10"=-
"11"=-
"12"=-
"13"=-

if you save this file from notepad to a .reg extension all you have to do is double click the file to edit the registry for you. since these values were in the sv (string value) you dont have to specify that in the script..it knows that by default..if it were a dword you would put dword: anyway another story there.. where i have "1" this is the way the registry showed the first restriction..then so on and so on for each game being restricted or program.. so by putting the "1"=- tells it to remove the sv value therefore allowing those programs to run freely with no policy against them.. i am not sure if the laptop was plugged back into the network if it would allow the GPO to override again and limit the games but i know it works when off network which is what i was needing.. thanks for the help..
  #4  
Old 8th February 2007, 00:51
skmrodgers skmrodgers is offline
Casual
Casual
 
 Join Date: Feb 2007
  6 month star 12 month star
 Posts: 4
 Reputation: skmrodgers is on a distinguished road (10)
Default Re: permanantly remove policy restriction for the current user

in the above example my posting put a space in the currentversion there is really no space there
  #5  
Old 8th February 2007, 08:17
sorinso's Avatar
sorinso sorinso is offline
Moderator
 
 Join Date: May 2006
  6 month star 12 month star
 Location: Haifa, Israel
 Posts: 3,065
 Reputation: sorinso is a name known to allsorinso is a name known to allsorinso is a name known to allsorinso is a name known to allsorinso is a name known to allsorinso is a name known to all (561)
Question Re: permanantly remove policy restriction for the current user

Hmmmmmmmm.... I'm puzzled here (and that's no easy situation for a Vulcan, you know).
What you did is to undo the changes in the Registry that the policy did. Thus making the policy useless. A policy that you seldom need, because
Quote:
they only come in once a year
So, the logical question to be asked is: why do you need this policy on these users anyway? To prevent them from playing games once a year?
You might want to consider not to apply the policy on these users, it will be lesser headaches.
But that's only my opinion.

OMG, Rick, is that vino I spot over there ?!?
__________________

Sorin Solomon


In order to succeed, your desire for success should be greater than your fear of failure.
- Bill Cosby

Last edited by sorinso; 8th February 2007 at 08:18.. Reason: WINE !!
  #6  
Old 8th February 2007, 20:23
skmrodgers skmrodgers is offline
Casual
Casual
 
 Join Date: Feb 2007
  6 month star 12 month star
 Posts: 4
 Reputation: skmrodgers is on a distinguished road (10)
Default Re: permanantly remove policy restriction for the current user

the issue was we use the policy for all our users here.. the salesmen laptops i setup here and then ship out to them.. when i set them up for outlook, etc through vpn i have to have them plugged into our network..once this was done it applied the policy..i thought nothing of it until they started calling from airports, etc complaining they could not pass the time away playing games.. so i needed a way to get them going without the need of them sending there laptops back to me.. i now have the policy set in groups so i will not run into this again..however for there sake it was too late for that fix..the future looks bright now though.. and i tried to have them just log back into network through vpn and have it remove policy itself but that wasnt working.. because they have to logon to laptop before they connect to vpn..so it wasnt removing the policy..hence i needed this to have a quick fix that didnt require the laptops being sent back and to prevent them from editing the registry themselves..
  #7  
Old 8th February 2007, 21:48
sorinso's Avatar
sorinso sorinso is offline
Moderator
 
 Join Date: May 2006
  6 month star 12 month star
 Location: Haifa, Israel
 Posts: 3,065
 Reputation: sorinso is a name known to allsorinso is a name known to allsorinso is a name known to allsorinso is a name known to allsorinso is a name known to allsorinso is a name known to all (561)
Default Re: permanantly remove policy restriction for the current user

Cool. That explains it...
Good luck, dude.
__________________

Sorin Solomon


In order to succeed, your desire for success should be greater than your fear of failure.
- Bill Cosby
  #8  
Old 12th February 2007, 00:45
guyt's Avatar
guyt guyt is offline
[MSFT]
Guru
 
 Join Date: Nov 2003
  6 month star 12 month star
 Location: Israel
 Posts: 1,766
  Send a message via MSN to guyt
 Reputation: guyt is a name known to allguyt is a name known to allguyt is a name known to allguyt is a name known to allguyt is a name known to allguyt is a name known to all (592)
Default Re: permanantly remove policy restriction for the current user

There are 2 standard ways to achieve what you want:

1) Put all those road warriors user/computer accounts in OUs that do not get the GPO in question applied

2) Use security filtering in the GPO: create security groups that contain road warriors user/computer accounts and add those with explicit deny on "Apply GPO".

Next time those connect to AD, the new GPO settings will apply.
__________________
Guy Teverovsky
http://blogs.technet.com/b/isrpfeplat/
"Smith & Wesson - the original point and click interface"
Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
User restriction moshik_levi GPO 12 5th January 2007 17:43
how to change user account name permanantly? jimmyjiang Windows 2000 Pro, XP Pro 9 10th December 2006 04:43
Software Restriction Policy - I can still run shortcuts deltamc2000 General Security 1 26th March 2006 09:13
User internet restriction ravx Windows Server 2000 / 2003 / 2003 R2 1 31st August 2005 14:56
Want to change current user to an admin, Windows 2000 Claire Forgot Administrator Password 4 16th June 2005 06:03


All times are GMT +3. The time now is 11:19.

Steel Blue 3.5.4 vBulletin Style ©2006 vBEnhanced
Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
 

Valid XHTML 1.0!   Valid CSS!

Copyright 2005 Daniel Petri