Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking at deploying SNMP Settings for windows servers via Group Policy and have an administrative template prepared. However I am noting strange behaviour when applying the policy.

Two Community strings are created, with different permissions. ie:


The Windows Registry also shows two values being created in


NAME         TYPE       DATA
1            REG_SZ     MYCOMMUNITY
MYCOMMUNITY  REG_DWORD  0x00000010 (16)

It is the latter of these two registry values that generates the READ CREATE community that I want, yet I seem to be unable to stop the first string entry from being generated.

My question is Whether READ CREATE Permissions will take precedence over READ ONLY permissions, or will there be "Random" behaviour with this configuration?


share|improve this question

For SNMP v1, you want the communities to be different, ie


Since there are no user names for SNMP v1, the community is what decides what the access level is. I don't know how Windows deals with this situation.

share|improve this answer
Hi David, agreed. There is supposed to be only 1 community called MYCOMMUNITY, yet the 2 regkeys gets created making it appear to be 2 communities of the same name. What I am wondering is whether as a result of this, MYCOMMUNITY will be READ ONLY, or will it be READ CREATE, or neither :) – Ben Short Feb 10 '10 at 4:23
up vote 0 down vote accepted

Have actually found a solution using Group Policy. Despite what I read yesterday, you can in fact delete registry values with an adm template. The policy code that solved this for me is as follows.

        POLICY "Delete Default SNMP Community"
            EXPLAIN "Deletes the first Community String from SNMP"
            KEYNAME "Software\Policies\SNMP\Parameters\ValidCommunities"
            VALUENAME "1"
            VALUEON DELETE
        END POLICY

Slightly different to the question asked, I know. However this achieves the result I needed - which was a single community which I know has READ CREATE access.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.