Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My understanding of the way group policy works is that some of the settings in the policy in effect make changes to the HKLM registry hive. They equally make changes in the HKCU part of the registry. So you could have a group policy that does something like importing this registry file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] "AutoRun"=dword:00000001

You can also have different group policies applied at the domain level and at the OU level. So let's assume we have an OU called SpecialComputers which has a group policy that (say) makes the above registry change.

My question is...

Are the registry settings that were applied as part of the OU associated group policy (e.g SpecialComputers) removed when you move the computer to another domain?

Or are they left as they are unless there are the same registry key/group policy settings in the new OU's group policy?

I don't think I've explained that very well but hope somebody gets the idea.

Cheers, Rob.

share|improve this question

Yes when a group policy is applied the registry changes that are a result of that policy remain. Joining a different domain will not remove these settings although they could be changed by the new domains policies.

share|improve this answer
That is what I suspected. We have a problem with proofing tools in Word 2007 on our XenApp servers and I suspect it's a bad registry key setting getting applied by group policy. So removing it to another OU won't help directly - but I will be able to manually remove the suspect keys to see if it helps. – Rob Nicholson Nov 12 '10 at 18:04

Managed policies are unapplied when they fall out of scope. If you have made custom policies that set registry keys they will stay when the policy is unapplied or falls out of scope because they aren't managed. Managed in this context means a real group policy setting.

Check it

GP policy settings will:

**not tattoo**. In other words, when a Group Policy object (GPO) goes

out of scope, the policy setting is removed allowing the original configuration value to be used.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.