4

We are beginning to deploy a couple of Windows 10 systems into our environment for application compatibility testing. Currently, we are Windows 7 x64 across the board. We've begun noticing recently on our W10 systems, that as soon as our Default Domain Policy GPO is applied, they begin experiencing a world of different problems. Most noticeably, just clicking on any objects (Start Menu, Apps) doesn't do anything. This issue is not present if you keep the machine in an OU where the Default Domain Policy is not applied.

Our Default Domain Policy has existed for a quite a while as our environment has progressed through 2000, 2003, and on to 2008 (Current DFL is 2008 R2). Inside the policy, there is a ton of old settings still present and unfortunately not a ton of documentation from the prior admin. I think I've narrowed down the issue to one particular group of settings.

The previous admin has the GPO touching a ton of Registry settings located at

(configured in the GPO as Computer Configuration\Policies\Windows Settings\Security Settings\Registry)

HKLM\Software\Classes

and then for, seemingly random reasons, random keys beneath it. The permissions that are being set against these keys tend to look fairly normal

SYSTEM Administrators Users Power Users INTERACTIVE

If I make a copy of the Default Domain Policy and remove this section, then my W10 systems operate as expected. For the life of me, I cannot figure out why this is configured or what it's doing short of maybe it was necessary when we were still a 2000/2003 domain. I'm hoping to gain a little insight on anyone who may have an idea on why this might be configured before I remove it from our Default Domain Policy.

Thank you all

closed as off-topic by Greg Askew, mdpc, yagmoth555, Jim B, MadHatter Apr 9 '16 at 5:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Please paste all the setting you set, else we cant guess what the registry keys do. – yagmoth555 Apr 4 '16 at 17:32
  • 2
    As a best practice never modify the default domain policy, create a new policy. If you are in a situation like this you'd have to use dcgpofix and that's not fun. This is also why it's not good to mess with registry changes directly. had the prior admin used policies, you'd have some idea of what each one does. (this is no criticism of the OP but is a great example for others reading of why NOT to do these things) – Jim B Apr 4 '16 at 18:39