Do HKLM registry keys get removed from group policy when changing organisational unit in Active Directory

active-directorygroup-policy

My understanding of the way group policy works is that some of the settings in the policy in effect make changes to the HKLM registry hive. They equally make changes in the HKCU part of the registry. So you could have a group policy that is equivalent to importing this registry file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun"=dword:00000001

You can also have different group policies applied at the domain level and at the OU level. So let's assume we have an OU called SpecialComputers which has a group policy that (say) makes the above registry change.

My question is…

Are the registry settings that were applied as part of the OU associated group policy (e.g SpecialComputers) removed when you move the computer to another domain?

Or are they left as they are unless there are the same registry key/group policy settings in the new OU's group policy?

Best Answer

When a group policy is applied the registry changes that are a result of that policy remain. Joining a different domain or moving to a new organization unit will not remove these settings although they could be changed by the new domain's policies.

Related Solutions

Active Directory Group Policy Security Groups Differ From User’s Groups

Have you checked your eventvwr logs? Do you have other Domain Controllers (DCs) in this domain? Which one is the Global Catalog (GC) FSMO? Try running

dcdiag.exe

and check the output for problems, especially with the SYSVOL and/or replication with other DCs.

THIS CAN BE DANGEROUS: If this is not the only DC in the directory, and the event logs don't reveal anything, try making a copy of the sysvol\domain\policies and place it elsewhere on the hard drive of the server. Make sure you do this during off hours and make sure you perform a complete AD backup using:

ntbackup.exe backup systemstate /J "pre-delete-ad-backup" /F "c:\adbackups\ForestBackup.bkf" /V:yes /M normal

Copy the ForestBackup.bkf off of the server after the backup is complete.

After you create the backup and copy it elsewhere, delete the sysvol\domain\policies directory. Then force a replication with another DC in the Directory using replmon.exe

Check the FRS eventlog and see if you get messages about a successful sysvol replication. Keep in mind that until Sysvol is restored in complete, your server will not be able act as a DC, so make sure that another DC is available to your clients...

Buffalo NAS Active Directory Integration Group Policy Changes

I am familiar with these devices and these particular changes. These settings do compromise security somewhat. I don't know that the practical risk is much better than the already sorry state of NTLMv2 and hash-based attacks, but it does increase risk somewhat. It would be nice if Buffalo spent some money addressing the need to downgrade security to support their devices.

To your second question: Anything you might do to create different security policy for different Domain Controllers (DCs) would result in an unsupported configuration and I'd advise against trying it. It might be possible to work something out but you'd be on your own re: support if it created oddball behavior.

Best Answer

Related Solutions

Active Directory Group Policy Security Groups Differ From User’s Groups

Buffalo NAS Active Directory Integration Group Policy Changes

Related Topic