5

When I apply a GPO that changes Service startup settings, where the default service startup settings are kept? And how can I read and modify them?

The reason of the question is that I have a hundred of servers where most of services are disabled by a baseline GPO for hardening purposes. I want to relax this GPO by removing some services but I do not want that the service startup settings becomes default ones after the GPO is relaxed. So I want to keep the actual hardened state as a default state but allow local admins to change it if necessary.

Thank you

2
  • How are the service states configured in the GPO, via preference, custom ADM(X), other?
    – jscott
    Oct 3, 2012 at 2:01
  • At this moment they are set via the System service section of the computer policy.
    – tester5566
    Oct 3, 2012 at 2:11

3 Answers 3

2

Pre-GPO local policy and default policy settings seem to be saved into c:\windows\security\database\secedit.sdb.

1

GPO settings are typically stored in the registry.

1
  • When there are no GPO, default Service startup settings are stored in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services. When a GPO applies it overwrites these settings but keeps somewhere a backup of default values. These values are restored when GPO is removed. So I am looking for these backup values.
    – tester5566
    Oct 3, 2012 at 1:54
1

The services won't revert to their default state, they'll revert to their pre-GPO state.

If a service has a default state of Manual and you change it to Automatic, then apply a GPO that disables the service, then set the GPO for that service to Not Defined the service will revert to the Automatic state, which is the state it was in pre-GPO.

4
  • I agree. By default I meant the pre-GPO state that was not modified in the most of cases.
    – tester5566
    Oct 3, 2012 at 2:07
  • Agreed in what you meant, but there's a technical difference. I just wanted to be clear about what happens. Carry on :)
    – joeqwerty
    Oct 3, 2012 at 2:17
  • In addition, this is a good question. I poured through the registry and couldn't figure out where it stores the pre-GPO state.
    – joeqwerty
    Oct 3, 2012 at 2:18
  • As for the User Rights section I had a similar question. It seems that they are written in the hidden part of the Registry under HKLM\Security where only LocalSystem has access. Hovewer I have found nothing about services in these keys.
    – tester5566
    Oct 3, 2012 at 2:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .