Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Scenario: I'm performing a configuration audit on a server that's joined to the domain. For the mandatory security configuration settings, there are group policies defined and being pushed out to domain members, but not all of the settings. The remaining settings are supposed to be defined locally on the server through one of the many configuration interfaces. Some of the settings are easy to audit because there are registry keys that are created. Others... not so much.

For example, if I want to check that the 'Network access: Allow anonymous SID/Name translation' settings has been configured properly, I have to use a RSOP call (via Powershell, or another tool like BigFix/TEM). The problem is that settings defined by local GPE aren't reflected in RSOP.

So, ultimately, the question is: is there a hidden hive in the registry where that setting, and others similar to it, are stored?

share|improve this question
As far as i know, the Windows registry is WYSIWYG. – DanBig Sep 18 '13 at 19:49
Instead of RSOP, what happens when you query for the registry key/values using REG.EXE? – Greg Askew Sep 19 '13 at 0:20

4 Answers 4

According to this TechNet article it appear that the key for the policy in question is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock

I can't think of any GPO settings that don't push down registry keys, so you can simply do something like:

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock

There is no "hidden" branch or anything like that. I'm not sure what you're talking about there. If a key doesn't exist, it is the same as not being configured.

share|improve this answer
The 'Anonymous SID/Name Translation' setting isn't controlled by the 'TurnOffAnonymousBlock' key - apparently in Server 2003, there was a registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa : AnonymousNameLookup that was created (at least according to various OVAL definitions and SCAP profiles that exist), but it doesn't seem to exist in Server 2008. From all appearances, it would appear that the 'Anonymous SID/Name Translation' setting doesn't have a corresponding key in the registry in Server 2008. – Dallas Moore Sep 19 '13 at 11:54
It certainly is controlled by that key. Have you tested it? – MDMarra Sep 19 '13 at 11:54
Is this a case of the 'TurnOffAnonymousBlock' key being an undocumented feature? I can't find any documentation that maps that key back to a setting that can be set in secedit or gpedit... – Dallas Moore Sep 19 '13 at 13:42
I'll grab a copy of procmon and find out for sure. – MDMarra Sep 19 '13 at 14:25

You can audit the Local GPO set on a system using a tool provided by someone from Microsoft called "LGPO_Utilities"

Read more here:

This tool can be used to set Local GPO, but it can also be used to export all current Local GPOs to a text file.

I use this tool to set Local GPO for many things that either require the settings to be set through Local GPO, or settings I want to enforce on users using Local GPO, but deployed through BigFix / IBM Endpoint Manager.

See this example:

I have a few other examples as well posted to

This question gives me the idea of creating a task that would be set to run every few days that would export all Local GPO settings so that they can be audited with a BigFix analysis.

share|improve this answer

The officiel list of GPO and registry key is there: Group Policy Settings Reference for Windows and Windows Server

That give big excel file with info like:

Administrative Templates\System\User Profiles Add the Administrators security group to roaming user profiles At least Microsoft Windows XP Professional or Windows Server 2003 family This setting adds the Administrator security group to the roaming user profile share. Once an administrator has configured a users' roaming profile, the profile will be created at the user's next login. The profile is created at the location that is specified by the administrator. For the Windows 2000 Professional and Windows XP Professional operating systems, the default file permissions for the newly generated profile are full control, or read and write access for the user, and no file access for the administrators group. By configuring this setting, you can alter this behavior. If you enable this setting, the administrator group is also given full control to the user's profile folder. If you disable or do not configure it, only the user is given full control of their user profile, and the administrators group has no file system access to this folder. Note: If the setting is enabled after the profile is created, the setting has no effect. Note: The setting must be configured on the client computer, not the server, for it to have any effect, because the client computer sets the file share permissions for the roaming profile at creation time. Note: In the default case, administrators have no file access to the user's profile, but they may still take ownership of this folder to grant themselves file permissions. Note: The behavior when this setting is enabled is exactly the same behavior as in Windows NT 4.0.

So find the key you want to audit from that document

share|improve this answer

I know I'm late to the party, but I spent some time myself on this today.

This is how I was able to get the value for the settings Network access: Allow anonymous SID/Name translation

$null = secedit /export /cfg $env:temp/secexport.cfg
$(gc $env:temp/secexport.cfg | Select-String "LSAAnonymousNameLookup").ToString().Split('=')[1].Trim()

This should return 0 if disabled and 1 if enabled.

It looks like no regkey is created for this setting, at least not one I could track down with procmon.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.