Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Scenario: I'm performing a configuration audit on a server that's joined to the domain. For the mandatory security configuration settings, there are group policies defined and being pushed out to domain members, but not all of the settings. The remaining settings are supposed to be defined locally on the server through one of the many configuration interfaces. Some of the settings are easy to audit because there are registry keys that are created. Others... not so much.

For example, if I want to check that the 'Network access: Allow anonymous SID/Name translation' settings has been configured properly, I have to use a RSOP call (via Powershell, or another tool like BigFix/TEM). The problem is that settings defined by local GPE aren't reflected in RSOP.

So, ultimately, the question is: is there a hidden hive in the registry where that setting, and others similar to it, are stored?

share|improve this question
As far as i know, the Windows registry is WYSIWYG. –  DanBig Sep 18 '13 at 19:49
Instead of RSOP, what happens when you query for the registry key/values using REG.EXE? –  Greg Askew Sep 19 '13 at 0:20

1 Answer 1

According to this TechNet article it appear that the key for the policy in question is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock

I can't think of any GPO settings that don't push down registry keys, so you can simply do something like:

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock

There is no "hidden" branch or anything like that. I'm not sure what you're talking about there. If a key doesn't exist, it is the same as not being configured.

share|improve this answer
The 'Anonymous SID/Name Translation' setting isn't controlled by the 'TurnOffAnonymousBlock' key - apparently in Server 2003, there was a registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa : AnonymousNameLookup that was created (at least according to various OVAL definitions and SCAP profiles that exist), but it doesn't seem to exist in Server 2008. From all appearances, it would appear that the 'Anonymous SID/Name Translation' setting doesn't have a corresponding key in the registry in Server 2008. –  Dallas Moore Sep 19 '13 at 11:54
It certainly is controlled by that key. Have you tested it? –  MDMarra Sep 19 '13 at 11:54
Is this a case of the 'TurnOffAnonymousBlock' key being an undocumented feature? I can't find any documentation that maps that key back to a setting that can be set in secedit or gpedit... –  Dallas Moore Sep 19 '13 at 13:42
I'll grab a copy of procmon and find out for sure. –  MDMarra Sep 19 '13 at 14:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.