Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two groups of computers (regular and hardened) and two groups of users (regular and administrators) and I need to have different registry settings for each combination (mostly windows policy settings)

Using HKEY_LOCAL_MACHINE wont work, because for each machine different users need different settings.

Using HKEY_USERS wont work, because for each user, different machines need different settings.

Any ideas how to work around this?

share|improve this question
up vote 2 down vote accepted

If you need a specific user registry setting to be applied when a user logs into a machine, then you can setup a GPO to write the registry setting based on creating it in the user portion of a GPO and assigning the security of that GPO to apply to those users.

Then create a WMI filter to filter the GPO to those users based on a WMI query that returns the fact that a computer is a member of a specific group or some other aspect of the server that would put it in the specific category of machine you are trying to enforce.

After that, apply the WMI filter to the GPO and that user based GPO will only apply to that user if the WMI filter, which pulls info from the machine, returns true.

share|improve this answer

Sounds like you would be able to accomplish this by just using Group Policies. If you need to change specify registry values that aren't already controlled by the group policy editor, perhaps you can simply create .reg files with values you require and apply them using logon scripts.

share|improve this answer
Could you explain how? as far as I know Group Policies also apply either to computers or to users - and not combinations of those. – Ophir Yoktan Mar 17 '11 at 21:27
They apply to both, or either, and you can link more than one policy to any OU. You can use Loopback Policy Processing to apply computer-based user settings to do this easily: – TristanK Mar 17 '11 at 21:51
We're operating under the assumption that you have a domain controller and these users and computers are all members of this domain. By using the Group Policy Management snap-in, you'll be able to create and apply multiple Group Policies and apply them to specific OU's and Groups. Technet article on Group Policy - – Lemb Mar 17 '11 at 22:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.