Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to run a .REG to add entries to the registry on logoff, but our GP environment disables regedit. I could probably accomplish this by turning regedit on, running the script, and then turning it back off again, but I'm hoping there's a more elegant solution than that.

share|improve this question
up vote 2 down vote accepted

Did you try REG.EXE?

REG.EXE allows you to do many Registry operations from a command line. This can be useful when you want to quickly make a change without opening RegEdit, and it also allows you to embed registry operations in logon scripts and batch files.

share|improve this answer
We're using the "disable access to registry editing tools" ADM. Will that allow me to run REG.EXE? – Doug Chase May 22 '09 at 12:15
It's worth testing - the policy looks like it specifically blocks the GUI tools, try a simple test like, reg query "HKLM/Software" > "%TMP%\REG-TEST-TEXT-FILE" in your logoff script. – nray May 22 '09 at 12:34
If REG.EXE works where REGEDIT is blocked you could substitute REG IMPORT your-reg-file.reg – nray May 22 '09 at 12:37
I'm afraid that is not possible. I guess nray's answer is right. You would have to check that flag "silent mode allowed" in your policy and run regedit /s – splattne May 22 '09 at 12:38
But anyway, please test it and let us know. – splattne May 22 '09 at 12:39

Why not use a WMI script, run using cscript.exe.

' taken from

' computer name we want to modify ("." for local, "pcname" for remote pc, no "\\" needed)
strComputer = "."

' leave these constants
const HKEY_LOCAL_MACHINE = &H80000002
Set StdOut = WScript.StdOut

' connect to the registry on the specified computer
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ 
strComputer & "\root\default:StdRegProv")

StdOut.WriteLine "Changing Registry on " & strComputer

' registry key we want to modify 
strKeyPath = "SOFTWARE\MyCompany\"

' create a new key.
' strKeyPath = "SOFTWARE\MyCompany\New registry folder"
' oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath

' write a string value
strValueName = "String Value Name"
strValue = "string value"
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue

' write a integer value
strValueName = "DWORD Value Name"
dwValue = 82
oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
share|improve this answer
Love WMI scripts...if this one works.....+1 – cop1152 Jun 3 '09 at 19:55

According to MS KB831787 Prevent Access to Registry Editing Tools policy changes in Windows XP and in Windows Server 2003 you can run regedit in silent mode, even on Windows XP/2003, if you update a GPO template.

From KB831787,

A new feature is available to change the way that Microsoft Windows XP and Microsoft Windows Server 2003 uses the Prevent Access to Registry Editing Tools policy. With this feature, you can configure a registry setting so that you can use one of the following configurations:

  • Registry Editor can be started either in interactive mode or in silent mode.
  • Registry Editor can be started only in silent mode (regedit /s). This is the default behavior in Windows 2000 and in Windows NT 4.0 when the Prevent Access to Registry Editing Tools policy is applied.
  • Registry Editor cannot be started at all. This is the default behavior in Windows XP when the Prevent Access to Registry Editing Tools policy is applied.
share|improve this answer
What I'm ultimately trying to do is to edit an HKU setting for all existing users and all new profiles on a specific OU. Am I approaching this the right way? How would you do it? – Doug Chase May 22 '09 at 13:16
I'm going to post this as a new question. – Doug Chase May 22 '09 at 13:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.