Search code examples
windowspowershellgroup-policy

How propagate modification of HKLM to gpedit?

I would to modify (enable and set value) of a Machine Group Policy with PowerShell. I understood this kind of Policy is based on Registry. That's why I tried to add my value with Set-ItemPropertycommand.

The new value is correctly set in registry but gpedit doesn't see it. I tried to use GroupPolicy commands but I don't see how address the Local Group Policy because I don't reach to get a correct GUID.

The key I want to chang is this one: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

I think I miss something but I don't know what. An Idea ?

Thanks

Solution

  • The answer you are looking for can be found at https://superuser.com/questions/1192405/why-gpedit-and-the-corresponding-registry-entries-are-not-synchronized

    Quoted from Wes

    Since the changes you make in the group policy editor affect what you see in the registry, it's perfectly logical to assume that the reverse is also true. However, it doesn't work that way.

    Local group policy settings (which is what I believe you are referring to in your post) are stored in registry.pol files located in C:\Windows\system32\GroupPolicy. These files overwrite the corresponding keys in the registry every time the system performs a group policy refresh. The editor never actually reads the registry to see what settings it contains.

    A group policy refresh is triggered whenever one of the following events occurs:

    • At a regularly scheduled refresh interval (every 90 minutes by default)
    • A user logon or logoff event (user policy only)
    • A computer reboot (computer policy only)
    • A manually triggered refresh via gpupdate
    • A policy refresh command issued by an admin from the domain controller (if the computer is domain-joined).

    It's important to remember that if the computer is domain-joined, domain policies will be applied after the local group policy files are processed (meaning that some settings may get overwritten by domain policy). You will not be able to see domain policies in the local group policy editor.