GPO Startup Script can’t modify HKU Registry

active-directorygroup-policywindows-registry

I've been scratching my head with my current problem.

You see, I have this Startup Script that I pushed via GPO.

Problem is, although the script starts alright (I see the event it created when starting in the event log), it always fails when trying to enumerate and/or modify registry settings under HKU.

  1. If I login as administrator and execute the script manually, it works!
  2. If I startup a Command Prompt as SYSTEM (using the "at" workaround) and execute the script manually, it also works!
  3. If I reboot… the script always fails.

Can anyone shed a light on my problem?

Additional information: This script injects some registry values for the Local Administrator (i.e., S-1-5-21-etc etc etc-500), so I'm not sure that it's doable via GPP, not to mention that since nearly all the workstations in my domain are still using XP, so no guarantee of GPP support.

Best Answer

As @tonyroth pointed out in the comment to my question, the HKU root is dynamically populated when a user logged in.

Therefore, to be able to access a subkey of HKU, I will need to manually (i.e., through the script) 'load' the proper hive onto a (temporary) subkey of HKU, edit it in place, then unload it again.

I found a nice example here: http://www.tek-tips.com/viewthread.cfm?qid=1314876

Edit: Also, to find where exactly the Hive of S-...-500 resides, I need to seek it out under HKLM as explained here: http://blogs.technet.com/b/heyscriptingguy/archive/2005/06/03/hey-scripting-guy-how-can-i-list-all-the-user-profiles-on-a-computer.aspx

Related Topic