1

I have an application running on the network that uses a .net component that requires a CASPOL policy to be applied. The client machines are locked down and local users are not administrators. What is the best method of deploying caspol via group policy (to avoid manually configuring a number of machines.)

3
  • Could you please elaborate on "deploying caspol" ? Pardon my ignorance, what "deploying" means?
    – Vick Vega
    Mar 31, 2016 at 3:52
  • Some .net applications need caspol statements to be run to give users permissions to run the application. (msdn.microsoft.com/en-us/library/cb6t8dtz(v=vs.110).aspx) A normal way to deploy them has been via batch file in startup scripts. Since changes to the group policy were made that no longer works as users aren't local administrators. We are trying to find a reliable way of running caspol scripts into machines on logon.
    – u07ch
    Mar 31, 2016 at 8:42
  • I posted my comment after looking at the same link, however have you considered deployment using PowerShell script?
    – Vick Vega
    Mar 31, 2016 at 23:18

1 Answer 1

0

Depending on your client machines OS you may achieve more complex configuration by deploying old-school configuration scripts (batch or powershell [if OS supports it]) that are triggered on startup (which requires the computer account to be able to at least reader from the network share).

Another option is to create a planned task using GPO that is executed within a specified user context and is triggered once upon logon.

4
  • Hi Daniel; I have put a comment on the original question. What is a reliable way of running a deployment in this circumstance. I can't find an example from GPO that does the update onto the local machine.
    – u07ch
    Mar 31, 2016 at 8:43
  • Check out gpo startup scripts - you can point to a given batch script that is executed upon machine start, not on user logon. Using a scheduled task, you can run the task with elevated privileagues. Mar 31, 2016 at 8:58
  • We have set this into a startup script and when it runs we get an error dialog popup saying the user can't write to the registry. Is there an override for that? Or a way to deploy a caspol setting directly into the registry without running it as a script?
    – u07ch
    Mar 31, 2016 at 15:50
  • What part of the registry is the CASPOL script trying to write to? Apr 3, 2016 at 15:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .