2

Background: I run a small computer lab of 10 computers using Windows 7 x64 Enterprise. Our users are set up as limited users. For additional restrictions, I set up local group policy for non-administrators using the microsoft management console.

Problem: Recently, I found out that some of these restrictions had been removed. Reviewing the settings MMC and in ntuser.pol showed that the settings should still be in place. However, the related registry settings were missing in ntuser.dat. I already have registry editing disabled in the GPO (though not in silent mode).

Question: What is the best way to deal with this situation? Should I look into preventing registry setting changes? Should I set up registry auditing to found out how these keys are getting changed in the first place? Or should I give up the ghost and write some kind of logon script that enforces registry values if they've been change? Any other ideas?

Improve this question
5
  • 3
    Can you not simply edit the ACLs of the registry entries in question to deny write permissions to that user group?
    – Synetech
    Jun 4, 2012 at 22:41
  • I hadn't thought of that. I will see if that works. Thanks.
    – graf_ignotiev
    Jun 6, 2012 at 17:48
  • My users only have read access to these keys, so I'm not sure how the keys are being changed. How could I investigate the issue further?
    – graf_ignotiev
    Jun 6, 2012 at 23:07
  • Is there some program that they use that requires admin rights? It is trivial to use that as a portal to do other things. For example, if you run a program with admin rights and it has some sort of Open File function, you could access cmd from there, right-click it and select run. It will be launched with admin rights as well, then you can do whatever you want. Do they also have limited file/folder rights? That's not guaranteed if they were able to hack the registry because they may have also changed the defaults and granted themselves access to the files as well.
    – Synetech
    Jun 6, 2012 at 23:46
  • They don't use any programs that require admin rights. I'm not sure what you mean by limited file/folder rights. At this point we can't be sure that it's even my users that are doing the changes. It could be a side affect of another program that may not even have malicious intents, but it does keep happening.
    – graf_ignotiev
    Jun 7, 2012 at 19:32

1 Answer 1

Reset to default
1

Okay, so the issue is that you made some changes with gpedit, but the changes are not present in the registry right? Have you checked to see if they are in the registry immediately after making the change with the policy editor?

You may want to audit the registry entries to find out who/what is changing them. That will make it much easier to stop it since as you considered, it may be something else (like a system process or something) that is making the change, so setting restrictions on the user group has no effect.

You can set it up with the Group Policy Editor, but I find the Permissions Dialog dialog to be easier:

enter image description here

Improve this answer
5
  • As an addendum, can you make suggestions as to what users I need to include?
    – graf_ignotiev
    Jun 8, 2012 at 22:12
  • I have no idea what users you have. You should add the Users group in general since they are the unelevated ones that should not be making changes to the key in question.
    – Synetech
    Jun 8, 2012 at 23:02
  • Well, the only users that can make changes to the key are the ones with the proper allow privileges in the Permissions tab. Shouldn't they be the ones I should add?
    – graf_ignotiev
    Jun 14, 2012 at 19:56
  • Huh? Do they have specific write privileges (i.e., they have write privileges set to their actual, individual usernames as opposed to just the administrator group)? If so, then why? Did you specifically add them? If you didn't then you can specifically remove their write-privileges or remove them altogether so that they inherit their privileges from the parent key.
    – Synetech
    Jun 15, 2012 at 0:29
  • Oops, I meant users, groups and security principles, not just users. Sorry about that. As it is, I will use the Everyone object to include anyone or anything that might alter the key.
    – graf_ignotiev
    Jun 15, 2012 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.