GPO and explicit registry permissions

  • Thread starter Thread starter pdch@shaw.ca
  • Start date Start date
P

pdch@shaw.ca

Guest
This is a follow-up to my posting on the "caseware" application.
Having determined which registry keys were 'access denied' using
processmonitor, and granting full access on the terminal server to
those keys, the problem still persists.

Is it possible that the GPO is denying access even though specific
registry access has been given on the terminal server?

Frustrated in IT....
 
Re: GPO and explicit registry permissions

Yes, GPOs will override local settings.
Use Resultat Set of Policy to find out which GPO is applying the setting.
/Henrik

<pdch@shaw.ca> skrev i meddelandet
news:1194458674.302681.51900@e34g2000pro.googlegroups.com...
> This is a follow-up to my posting on the "caseware" application.
> Having determined which registry keys were 'access denied' using
> processmonitor, and granting full access on the terminal server to
> those keys, the problem still persists.
>
> Is it possible that the GPO is denying access even though specific
> registry access has been given on the terminal server?
>
> Frustrated in IT....
>
 
Re: GPO and explicit registry permissions

Hi,

You never answered the question I asked before. Here it is
from the earlier thread:

Are they referring to the group policy setting "Prevent access to
registry editing tools"? If you have this set to enabled have you
tried Disabling it or setting it to Not Configured to see if the error
still occurs (just for testing).

I am asking this to try and determine if the program has a hard
coded check to see if reg editing is disabled via gpo and then
displaying an error if so.

Are you using filtering in process monitor to make it easier to
spot problems? Make sure you are filtering on all of the
caseware exes that may run (some programs launch other
exes while they are running).

If you are not very careful in how you use process monitor it
is easy to miss problems.

What happens if temporarily make a problem user a member
of Administrators, logon as them, run the app, logoff, and then
remove them from Administrators? Does the problem still
occur next time they logon?

-TP

pdch@shaw.ca wrote:
> This is a follow-up to my posting on the "caseware" application.
> Having determined which registry keys were 'access denied' using
> processmonitor, and granting full access on the terminal server to
> those keys, the problem still persists.
>
> Is it possible that the GPO is denying access even though specific
> registry access has been given on the terminal server?
>
> Frustrated in IT....
 
Re: GPO and explicit registry permissions

On Nov 7, 1:44 pm, "TP" <tperson.knowsp...@mailandnews.com> wrote:
> Hi,
>
> You never answered the question I asked before. Here it is
> from the earlier thread:
>
> Are they referring to the group policy setting "Prevent access to
> registry editing tools"? If you have this set to enabled have you
> tried Disabling it or setting it to Not Configured to see if the error
> still occurs (just for testing).
>
> I am asking this to try and determine if the program has a hard
> coded check to see if reg editing is disabled via gpo and then
> displaying an error if so.
>
> Are you using filtering in process monitor to make it easier to
> spot problems? Make sure you are filtering on all of the
> caseware exes that may run (some programs launch other
> exes while they are running).
>
> If you are not very careful in how you use process monitor it
> is easy to miss problems.
>
> What happens if temporarily make a problem user a member
> of Administrators, logon as them, run the app, logoff, and then
> remove them from Administrators? Does the problem still
> occur next time they logon?
>
> -TP
>
>
>
> p...@shaw.ca wrote:
> > This is a follow-up to my posting on the "caseware" application.
> > Having determined which registry keys were 'access denied' using
> > processmonitor, and granting full access on the terminal server to
> > those keys, the problem still persists.
>
> > Is it possible that the GPO is denying access even though specific
> > registry access has been given on the terminal server?
>
> > Frustrated in IT....- Hide quoted text -
>
> - Show quoted text -

Hi TP and Henrik,

TP .... no I profess I did not try your idea. I will tonight. Sincere
thanks for taking the time to make the suggestion.

Henrik... after I try TP's idea, I'll look at your suggestion too if
TP's doesn't work. Thanks for the idea!
 
Back
Top