I have a domain (2003 Functional Level) with a mix of Windows XP and Windows 7 clients. We have been using Group Policy to manage our workstations.
Now, I am in a situation I need to apply different GPO Policies (not Preferences) based on some complex logic. I might be able to create multiple GPOs and do security/WMI filtering, but it's going to get messy. A script would be a much cleaner approach for us (PowerShell specifically).
What I want to do:
I want to use startup scripts to enable GPO Policies. It seems that my logon scripts could edit the contents of HKEY_LOCAL_MACHINE\SOFTWARE\Policies and HKEY_CURRENT_USER\SOFTWARE\Policies. These registry entries are well documented and setting them is pretty straightforward. I have seen plenty of cases of people doing this online, but I want to make sure this is a sane idea before I do it.
The PCs will still be joined to the domain, and there will still be some GPOs present (Default Domain Policy at the very least). So, conflicts with any existing policies is a possibility. I am expecting the following will happen:
- If the policy item is "not configured" in a GPO, there is no conflict. The registry value in my the startup script will be written and the policy will take effect.
- If the policy item is set to Disabled/Enabled in the GPO, it will collide with my script. The script may "win" at startup, but during background refresh it will get overwritten.
So, is my understanding correct? Is this an OK thing to do?