Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My understanding of the way group policy works is that some of the settings in the policy in effect make changes to the HKLM registry hive. They equally make changes in the HKCU part of the registry. So you could have a group policy that is equivalent to importing this registry file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] "AutoRun"=dword:00000001

You can also have different group policies applied at the domain level and at the OU level. So let's assume we have an OU called SpecialComputers which has a group policy that (say) makes the above registry change.

My question is...

Are the registry settings that were applied as part of the OU associated group policy (e.g SpecialComputers) removed when you move the computer to another domain?

Or are they left as they are unless there are the same registry key/group policy settings in the new OU's group policy?

share|improve this question

When a group policy is applied the registry changes that are a result of that policy remain. Joining a different domain or moving to a new organization unit will not remove these settings although they could be changed by the new domain's policies.

share|improve this answer
    
That is what I suspected. We have a problem with proofing tools in Word 2007 on our XenApp servers and I suspect it's a bad registry key setting getting applied by group policy. So removing it to another OU won't help directly - but I will be able to manually remove the suspect keys to see if it helps. – Rob Nicholson Nov 12 '10 at 18:04

Managed policies are unapplied when they fall out of scope. If you have made custom policies that set registry keys they will stay when the policy is unapplied or falls out of scope because they aren't managed. Managed in this context means a real group policy setting.

Check it

GP policy settings will:

**not tattoo**. In other words, when a Group Policy object (GPO) goes

out of scope, the policy setting is removed allowing the original configuration value to be used.

share|improve this answer

This is not a Yes/No question. Administrative Templates GPO settings that are actually stored in Software\Policies and Software\Microsoft\Windows\CurrentVersion\Policies (both HKLM and HKCU) are removed when the policy falls out of scope. Any Windows Settings or other Administrative Templates settings that ultimately set a registry value will persist even when out of scope. The reason is that Windows does not store any history for registry settings. If Windows blindly removed registry settings, it could break something. However, of course, my statements are subject to exceptions based on the whims of the Windows developers.

I am specifically excluding Group Policy Preferences; those behave completely differently.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.