GPO and explicit registry permissions

[Guest pdch@shaw.ca]

This is a follow-up to my posting on the "caseware" application.

Having determined which registry keys were 'access denied' using

processmonitor, and granting full access on the terminal server to

those keys, the problem still persists.

 

Is it possible that the GPO is denying access even though specific

registry access has been given on the terminal server?

 

Frustrated in IT....

[Guest Henrik Johansson]

Re: GPO and explicit registry permissions

 

Yes, GPOs will override local settings.

Use Resultat Set of Policy to find out which GPO is applying the setting.

/Henrik

 

<pdch@shaw.ca> skrev i meddelandet

news:1194458674.302681.51900@e34g2000pro.googlegroups.com...

> This is a follow-up to my posting on the "caseware" application.

> Having determined which registry keys were 'access denied' using

> processmonitor, and granting full access on the terminal server to

> those keys, the problem still persists.

>

> Is it possible that the GPO is denying access even though specific

> registry access has been given on the terminal server?

>

> Frustrated in IT....

>

[Guest TP]

Re: GPO and explicit registry permissions

 

Hi,

 

You never answered the question I asked before. Here it is

from the earlier thread:

 

Are they referring to the group policy setting "Prevent access to

registry editing tools"? If you have this set to enabled have you

tried Disabling it or setting it to Not Configured to see if the error

still occurs (just for testing).

 

I am asking this to try and determine if the program has a hard

coded check to see if reg editing is disabled via gpo and then

displaying an error if so.

 

Are you using filtering in process monitor to make it easier to

spot problems? Make sure you are filtering on all of the

caseware exes that may run (some programs launch other

exes while they are running).

 

If you are not very careful in how you use process monitor it

is easy to miss problems.

 

What happens if temporarily make a problem user a member

of Administrators, logon as them, run the app, logoff, and then

remove them from Administrators? Does the problem still

occur next time they logon?

 

-TP

 

pdch@shaw.ca wrote:

> This is a follow-up to my posting on the "caseware" application.

> Having determined which registry keys were 'access denied' using

> processmonitor, and granting full access on the terminal server to

> those keys, the problem still persists.

>

> Is it possible that the GPO is denying access even though specific

> registry access has been given on the terminal server?

>

> Frustrated in IT....

[Guest pdch@shaw.ca]

Re: GPO and explicit registry permissions

 

On Nov 7, 1:44 pm, "TP" <tperson.knowsp...@mailandnews.com> wrote:

> Hi,

>

> You never answered the question I asked before. Here it is

> from the earlier thread:

>

> Are they referring to the group policy setting "Prevent access to

> registry editing tools"? If you have this set to enabled have you

> tried Disabling it or setting it to Not Configured to see if the error

> still occurs (just for testing).

>

> I am asking this to try and determine if the program has a hard

> coded check to see if reg editing is disabled via gpo and then

> displaying an error if so.

>

> Are you using filtering in process monitor to make it easier to

> spot problems? Make sure you are filtering on all of the

> caseware exes that may run (some programs launch other

> exes while they are running).

>

> If you are not very careful in how you use process monitor it

> is easy to miss problems.

>

> What happens if temporarily make a problem user a member

> of Administrators, logon as them, run the app, logoff, and then

> remove them from Administrators? Does the problem still

> occur next time they logon?

>

> -TP

>

>

>

> p...@shaw.ca wrote:

> > This is a follow-up to my posting on the "caseware" application.

> > Having determined which registry keys were 'access denied' using

> > processmonitor, and granting full access on the terminal server to

> > those keys, the problem still persists.

>

> > Is it possible that the GPO is denying access even though specific

> > registry access has been given on the terminal server?

>

> > Frustrated in IT....- Hide quoted text -

>

> - Show quoted text -

 

Hi TP and Henrik,

 

TP .... no I profess I did not try your idea. I will tonight. Sincere

thanks for taking the time to make the suggestion.

 

Henrik... after I try TP's idea, I'll look at your suggestion too if

TP's doesn't work. Thanks for the idea!