[skmrodgers]

is there a way to permanantly remove policy restriction on a pc? my issue is we have a GPO on our pc's here at work to not allow certain programs to be executed or run..(games, ex: sol, pinball, etc..) i have several laptops that i setup for our salesmen who are always on road and travel and they dont have to be in the restriction.. when they are at airports, hotels, etc..they are allowed to play..i was wondering if there was a way to remoave the GPO on there laptops without them having to bring them in to me.. they have admin rights on the laptop and i know the program here you can download kills the policy temporarily.. i want to disable it permanatly from the laptop without the need of them bringing the laptop back in.. they only come in once a year.. they all live nationwide.. can this be done? i figure if it can be done temp it can be done perm? thanks steve

[rvalstar]

I think you can accomplish this by denying access to registry.pol as JeremyW suggests for a different issue in this thread:

http://www.petri.co.il/forums/showth...0948#post50948

Let us know if you need more info / how it works out.

Thanks Jeremy

[skmrodgers]

i figured out another way in case anybody wants to know what i did.. i went into the registry and searched and found where the policy is that restricts the games being played.. it is in the:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer\DisallowRun]

so from here i figured i would write a script that would remove the entries so that i could send this file to all the salesmen on the road and they would not have to worry about editing the registry themselves..(this could be dangerous) and of course please export your registry in case of anything going wrong before you ever edit the registry.. but here is the script i wrote and it worked to perfection. everything is working perfectly and i have found no issues of anything else not working properly.. :


[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer\DisallowRun]
"1"=-
"2"=-
"3"=-
"4"=-
"5"=-
"6"=-
"7"=-
"8"=-
"9"=-
"10"=-
"11"=-
"12"=-
"13"=-

if you save this file from notepad to a .reg extension all you have to do is double click the file to edit the registry for you. since these values were in the sv (string value) you dont have to specify that in the script..it knows that by default..if it were a dword you would put dword: anyway another story there.. where i have "1" this is the way the registry showed the first restriction..then so on and so on for each game being restricted or program.. so by putting the "1"=- tells it to remove the sv value therefore allowing those programs to run freely with no policy against them.. i am not sure if the laptop was plugged back into the network if it would allow the GPO to override again and limit the games but i know it works when off network which is what i was needing.. thanks for the help..

[skmrodgers]

in the above example my posting put a space in the currentversion there is really no space there

[sorinso]

Hmmmmmmmm.... I'm puzzled here (and that's no easy situation for a Vulcan, you know).
What you did is to undo the changes in the Registry that the policy did. Thus making the policy useless. A policy that you seldom need, because

they only come in once a year

So, the logical question to be asked is: why do you need this policy on these users anyway? To prevent them from playing games once a year?
You might want to consider not to apply the policy on these users, it will be lesser headaches.
But that's only my opinion.

OMG, Rick, is that vino I spot over there ?!?

[skmrodgers]

the issue was we use the policy for all our users here.. the salesmen laptops i setup here and then ship out to them.. when i set them up for outlook, etc through vpn i have to have them plugged into our network..once this was done it applied the policy..i thought nothing of it until they started calling from airports, etc complaining they could not pass the time away playing games.. so i needed a way to get them going without the need of them sending there laptops back to me.. i now have the policy set in groups so i will not run into this again..however for there sake it was too late for that fix..the future looks bright now though.. and i tried to have them just log back into network through vpn and have it remove policy itself but that wasnt working.. because they have to logon to laptop before they connect to vpn..so it wasnt removing the policy..hence i needed this to have a quick fix that didnt require the laptops being sent back and to prevent them from editing the registry themselves..

[sorinso]

Cool. That explains it...
Good luck, dude.

[guyt]

There are 2 standard ways to achieve what you want:

1) Put all those road warriors user/computer accounts in OUs that do not get the GPO in question applied

2) Use security filtering in the GPO: create security groups that contain road warriors user/computer accounts and add those with explicit deny on "Apply GPO".

Next time those connect to AD, the new GPO settings will apply.