Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Background: I run a small computer lab of 10 computers using Windows 7 x64 Enterprise. Our users are set up as limited users. For additional restrictions, I set up local group policy for non-administrators using the microsoft management console.

Problem: Recently, I found out that some of these restrictions had been removed. Reviewing the settings MMC and in ntuser.pol showed that the settings should still be in place. However, the related registry settings were missing in ntuser.dat. I already have registry editing disabled in the GPO (though not in silent mode).

Question: What is the best way to deal with this situation? Should I look into preventing registry setting changes? Should I set up registry auditing to found out how these keys are getting changed in the first place? Or should I give up the ghost and write some kind of logon script that enforces registry values if they've been change? Any other ideas?

share|improve this question
3  
Can you not simply edit the ACLs of the registry entries in question to deny write permissions to that user group? –  Synetech Jun 4 '12 at 22:41
    
I hadn't thought of that. I will see if that works. Thanks. –  graf_ignotiev Jun 6 '12 at 17:48
    
My users only have read access to these keys, so I'm not sure how the keys are being changed. How could I investigate the issue further? –  graf_ignotiev Jun 6 '12 at 23:07
    
Is there some program that they use that requires admin rights? It is trivial to use that as a portal to do other things. For example, if you run a program with admin rights and it has some sort of Open File function, you could access cmd from there, right-click it and select run. It will be launched with admin rights as well, then you can do whatever you want. Do they also have limited file/folder rights? That's not guaranteed if they were able to hack the registry because they may have also changed the defaults and granted themselves access to the files as well. –  Synetech Jun 6 '12 at 23:46
    
They don't use any programs that require admin rights. I'm not sure what you mean by limited file/folder rights. At this point we can't be sure that it's even my users that are doing the changes. It could be a side affect of another program that may not even have malicious intents, but it does keep happening. –  graf_ignotiev Jun 7 '12 at 19:32

1 Answer 1

up vote 1 down vote accepted

Okay, so the issue is that you made some changes with gpedit, but the changes are not present in the registry right? Have you checked to see if they are in the registry immediately after making the change with the policy editor?

You may want to audit the registry entries to find out who/what is changing them. That will make it much easier to stop it since as you considered, it may be something else (like a system process or something) that is making the change, so setting restrictions on the user group has no effect.

You can set it up with the Group Policy Editor, but I find the Permissions Dialog dialog to be easier:

enter image description here

share|improve this answer
    
As an addendum, can you make suggestions as to what users I need to include? –  graf_ignotiev Jun 8 '12 at 22:12
    
I have no idea what users you have. You should add the Users group in general since they are the unelevated ones that should not be making changes to the key in question. –  Synetech Jun 8 '12 at 23:02
    
Well, the only users that can make changes to the key are the ones with the proper allow privileges in the Permissions tab. Shouldn't they be the ones I should add? –  graf_ignotiev Jun 14 '12 at 19:56
    
Huh? Do they have specific write privileges (i.e., they have write privileges set to their actual, individual usernames as opposed to just the administrator group)? If so, then why? Did you specifically add them? If you didn't then you can specifically remove their write-privileges or remove them altogether so that they inherit their privileges from the parent key. –  Synetech Jun 15 '12 at 0:29
    
Oops, I meant users, groups and security principles, not just users. Sorry about that. As it is, I will use the Everyone object to include anyone or anything that might alter the key. –  graf_ignotiev Jun 15 '12 at 22:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.