Powershell – How to enable a local group policy setting with PowerShell and/or an API

automationgroup-policypowershell

I just discovered I have to enable a local group policy setting (Computer Configuration -> Administrative Templates -> System -> UserProfiles) on a server running a specific application. I have a PowerShell installation script I use to install the application and configure the server. I'd like to be able to enable this group policy in my installation script. Is there a way to do this in PowerShell? If not, any other technology? I'm comfortable using the Win32 API, if that is my only option.

Best Answer

Most group policy settings are just registry keys under HKLM\Software\Policies. If your PowerShell script runs as Adminstrator, you can just set the corresponding registry value and achieve the same effect without touching Group Policy.

The mappings between registry values and GPO settings is documented by Microsoft. https://www.microsoft.com/en-us/download/details.aspx?id=25250

Related Solutions

Windows Group Policy – Can I alter with VBscript

It's possible, yes.

Not really advisable, because the supported and recommended way to do this is through the gpedit.msc tool (or GPOs on a domain). As a result, doing it with a script is semi-documented at best, and you do run into some oddities trying.

If you're still determined to try, theses settings are really just registry keys. If can figure out which keys are changed, it's trivial to script something up to import all those registry keys and end up with the desired configuration. I'd just use a batch file, honestly.

The problem you'll run into, however, is that these changes need to be saved to %SYSTEM ROOT%\System32\GroupPolicy\User\Registry.pol to be enforced as local group policy, and I don't know of a good scripted solution to that, so the common workaround is to set this up the way you want on a second machine, and copy the %SYSTEM ROOT%\System32\GroupPolicy\User folder and files to your target machines.

I personally find the whole thing to be such a pain that I'd rather set up a small domain than go through that process to apply automate applying local group policy.

Powershell – Edit local policy via powershell

This is how i resolved it :

New-ItemProperty -Path 'hklm:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation' -Name "AllowFreshCredentialsWhenNTLMOnly" -Value 1 -PropertyType Dword -Force     

New-Item -Path 'hklm:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation'  -Name "AllowFreshCredentialsWhenNTLMOnly" -Value "Default Value" -Force

New-ItemProperty  -Path 'hklm:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentialsWhenNTLMOnly' -Name "1" -PropertyType "String" -Value '*'

Best Answer

Related Solutions

Windows Group Policy – Can I alter with VBscript

Powershell – Edit local policy via powershell

Related Topic