4

Is there a way to change or edit certain group policies via command line?

We are currently installing a lot of PCs based on an image. After the install is done, certain group policies need to be changed, which we have to do manually at this point.

I Would like to add these changes in a script so I can create a script per department to enforce these group policies.

For example: Set "Computer Configuration / Management Templates / Configuration Panel / Online Tooltips" to "disabled" via a script.

Thanks!

Joe
  • 163
  • 1
  • 5
  • 21
  • Take a look at this other question. It might address your need. https://superuser.com/questions/365699/change-group-policy-using-windows-cmd – Doug Deden Jan 23 '19 at 15:27
  • Why aren't you deploying group policies via Active Directory? – u1686_grawity Jan 23 '19 at 15:31
  • 1
    Thanks for all suggestions! @grawity: We are deploying group policies via Active Directory, but some policies are only needed temporarily during installation. – Joe Jan 24 '19 at 10:12
  • @Joe: Then I'd still stick with AD GPO but e.g. use security filtering so that it only applies to computers within a specific group. – u1686_grawity Jan 24 '19 at 12:07
  • @grawity: I don't know what you mean. I meant that there are policies which we need to enable, only to disable them half an hour later on. Surely using AD for such a situation would be less convenient than running a script with an enable/disable in it? – Joe Jan 25 '19 at 13:04

3 Answers3

3

Since the Group Policy settings are stored in the Registry, the easiest method to create department-wide configurations might be through a .reg file,

Microsoft maintains a list of the Group Policy Registry keys. For example, line 188 shows HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!AllowOnlineTips controls online tooltips.

Rather than synthesizing the .reg script from scratch, you could "reverse engineer" such a script by taking a snapshot of the Registry of a freshly created clone, applying appropriate changes through the Group Policy Editor, and then diffing that snapshot with a new one. An excellent tool for this purpose is Nirsoft's RegistryChangesView, which can "export the Registry changes into a standard .reg file".

Of course, if you're running a batch script anyway, just add a line to it:

regedit.exe /s "full path to your .reg file"

You can also import .reg files through the GPE using PowerShell.

DrMoishe Pippik
  • 25,661
  • 4
  • 36
  • 54
2

I would not recommend to rely on registry changes when I want to achieve a policy. A policy isn't always a registry entry and vice versa... Especially when it comes to the processing order there are differences as well as the stage of implementation (image, pre- / post-sysprep) depending on the hive (if the policy sets a registry value).

From personal experience I would prefer to set and apply a GPO rather than editing reg values manually. We hat the issue that reg settings were not finding there way back to the policy and policy settings were overriding the reg value.

Some nice way are PS cmdlets very well explained here: https://www.powershellmagazine.com/2012/05/14/managing-group-policy-with-powershell/

Matthias Fleschütz
  • 21
  • 2
0

Some policies are stored in C:\Windows\System32\GroupPolicy in CSV format.

Audit policies can be set via auditpol command.

George Sovetov
  • 206
  • 1
  • 14