Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I apply a GPO that changes Service startup settings, where the default service startup settings are kept? And how can I read and modify them?

The reason of the question is that I have a hundred of servers where most of services are disabled by a baseline GPO for hardening purposes. I want to relax this GPO by removing some services but I do not want that the service startup settings becomes default ones after the GPO is relaxed. So I want to keep the actual hardened state as a default state but allow local admins to change it if necessary.

Thank you

share|improve this question
How are the service states configured in the GPO, via preference, custom ADM(X), other? – jscott Oct 3 '12 at 2:01
At this moment they are set via the System service section of the computer policy. – tester5566 Oct 3 '12 at 2:11

Pre-GPO local policy and default policy settings seem to be saved into c:\windows\security\database\secedit.sdb.

share|improve this answer

GPO settings are typically stored in the registry.

share|improve this answer
When there are no GPO, default Service startup settings are stored in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services. When a GPO applies it overwrites these settings but keeps somewhere a backup of default values. These values are restored when GPO is removed. So I am looking for these backup values. – tester5566 Oct 3 '12 at 1:54

The services won't revert to their default state, they'll revert to their pre-GPO state.

If a service has a default state of Manual and you change it to Automatic, then apply a GPO that disables the service, then set the GPO for that service to Not Defined the service will revert to the Automatic state, which is the state it was in pre-GPO.

share|improve this answer
I agree. By default I meant the pre-GPO state that was not modified in the most of cases. – tester5566 Oct 3 '12 at 2:07
Agreed in what you meant, but there's a technical difference. I just wanted to be clear about what happens. Carry on :) – joeqwerty Oct 3 '12 at 2:17
In addition, this is a good question. I poured through the registry and couldn't figure out where it stores the pre-GPO state. – joeqwerty Oct 3 '12 at 2:18
As for the User Rights section I had a similar question. It seems that they are written in the hidden part of the Registry under HKLM\Security where only LocalSystem has access. Hovewer I have found nothing about services in these keys. – tester5566 Oct 3 '12 at 2:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.