1

I have configured local Group Policy Objects on a Windows 10 Enterprise machine. After that, I exported these GPOs with the Microsoft tool LGPO with:

LGPO.exe /b [path]

This all works fine. Now I used this GPO export to import it on a second installation (identical), like so:

LGPO.exe /g [path to export]

Everything seems to work as expected, there are no errors during the process. After that, I updated the policies like

gpupdate /force

I can tell that some policies did in fact apply correctly, but some didn't. After looking into gpedit, I found that some of the policies regarding the "Security Template" did in fact not import (but some did). Why would this happen? I used the same technique before and it worked as far as I remember.

After further investigation into the LGPO export, I found that the settings regarding the Security Template are found in this file: [Export-ID]\DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf.

This file is structured like this:

[Unicode]
...
[System Access]
...
[Event Audit]
...
[Registry Values]
... <-- These registry values listed here are not imported at all
// some examples 
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,"1"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,"2"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,"1"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,"1"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,7
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1,"1"
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLockedUserId=4,1
[Privilege Rights]
...
[Version]
...

So, how come that the list of settings stored in the "Registry Values" section does not import correctly?

Edit:

I also tried to reinstall the second windows machine, but still no luck.

6
  • Ah bless, its you again. You already helped me with a windows issue recently :D. Yes, these are all machine level local registry settings. All these values that are imported via this GptTmpl.inf can be found in the policy editor (gpedit) under Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options. Dec 1, 2020 at 14:00
  • @FormerlyPimpJuiceIT I added some examples of the settings that are not imported correctly. Dec 1, 2020 at 14:06
  • Thanks for your input. I have indeed tried all of these methods. Applying the security template via /s does not change anything. This is basically what is done behind the scenes when doing the full import via /b. But I've also tried to do it seperately, but it didn't change the outcome. Showing the whole output via /v gives some information, but basically just shows that everything worked fine. Dec 1, 2020 at 15:00
  • I already tried to check the Event Viewer entries. On the initial import it states that policy changes were found and that they were imported. (No errors) When then trying to apply / overwrite the security options manually (via /s) it states in the events that no new settings were applied. Dec 2, 2020 at 6:42
  • 1
    @FormerlyPimpJuiceIT I still appreciate your effort, thanks a lot. I will probably resort to some workaround myself, which is "ok" for me. But I was still curious on why this didn't work when I know it once did. Anyways, thanks again! Dec 4, 2020 at 6:52

0

You must log in to answer this question.

Browse other questions tagged .