2

My understanding of the way group policy works is that some of the settings in the policy in effect make changes to the HKLM registry hive. They equally make changes in the HKCU part of the registry. So you could have a group policy that is equivalent to importing this registry file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] "AutoRun"=dword:00000001

You can also have different group policies applied at the domain level and at the OU level. So let's assume we have an OU called SpecialComputers which has a group policy that (say) makes the above registry change.

My question is...

Are the registry settings that were applied as part of the OU associated group policy (e.g SpecialComputers) removed when you move the computer to another domain?

Or are they left as they are unless there are the same registry key/group policy settings in the new OU's group policy?

5

When a group policy is applied the registry changes that are a result of that policy remain. Joining a different domain or moving to a new organization unit will not remove these settings although they could be changed by the new domain's policies.

  • That is what I suspected. We have a problem with proofing tools in Word 2007 on our XenApp servers and I suspect it's a bad registry key setting getting applied by group policy. So removing it to another OU won't help directly - but I will be able to manually remove the suspect keys to see if it helps. – Rob Nicholson Nov 12 '10 at 18:04
0

Managed policies are unapplied when they fall out of scope. If you have made custom policies that set registry keys they will stay when the policy is unapplied or falls out of scope because they aren't managed. Managed in this context means a real group policy setting.

Check it

GP policy settings will:

**not tattoo**. In other words, when a Group Policy object (GPO) goes

out of scope, the policy setting is removed allowing the original configuration value to be used.

0

This is not a Yes/No question. Administrative Templates GPO settings that are actually stored in Software\Policies and Software\Microsoft\Windows\CurrentVersion\Policies (both HKLM and HKCU) are removed when the policy falls out of scope. Any Windows Settings or other Administrative Templates settings that ultimately set a registry value will persist even when out of scope. The reason is that Windows does not store any history for registry settings. If Windows blindly removed registry settings, it could break something. However, of course, my statements are subject to exceptions based on the whims of the Windows developers.

I am specifically excluding Group Policy Preferences; those behave completely differently.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.