5

Is it possible to disable updates to the group policy? I see an option to set an update interval to 45 days - can I disable all updates completely? I want to stop stuff from the corporate network from overwriting the hacks I make locally.

3
  • Its only possible if you are an admin of the domain itself.
    – Ramhound
    Mar 20 '14 at 13:55
  • 5
    I hope you are the network admin or whomever is responsible for such things is aware that you are doing this. At most companies, doing stuff like this is a fast track to unemployment.
    – Richie086
    Mar 20 '14 at 14:00
  • Do you have administrative permissions to your domain's Group Policy? Jun 24 '15 at 17:30
2

Don't do this. Your system administrator will know if you disable group policy completely. On top of that, many administrators use GPOs to deploy and manage software. When your computer doesn't report back as having the most recent version of the software, an Admin's head will tilt to the side slightly - and he's going to investigate the reason.

It is MUCH easier to override specific GPO objects you don't like, such as your home page being set in chrome (which could also be part of the way the software is deployed as much as a GPO object, as GPO generally only applies to M$ products). - Check this out - https://serverfault.com/questions/593937/can-i-override-domain-group-policy-with-local-group-policy-as-a-local-admin

If you create local GPO rules for the things you don't want mandated by your company - 1. The sysadmins are less likely to elevate your hackish tendancies to management, thus getting you fired, and 2. The sysadmins will probably tell you exactly how to do it. The home page being set static is usually both a security mandate, as well as a user support fix. I don't know how many times I've had people call because they can't find site X or Y, all of which are linked on our corporate portal home page... all because the user has changed their home page.

3

While it's important to keep the possible repercussions of your actions in mind, it is possible to disable group policy updates by deleting or (preferably) renaming the gpupdate.exe application in System32. To do this, you'll need to be a local administrator and take ownership of the file, then give yourself full control in the security tab.

1

If you have local admin privileges, maybe you could alter the ACL of the registry keys affected by the GPO to prevent them from being applied, as GPO's are basically remotely modified registry keys.

Meaning, if you were to deny the domain from having read/write access to these registry keys, that portion of the GPO cannot be applied.

Problem is you'll need to do it for every setting you want to preserve, one key for wallpaper, different key for home page, etc etc.

4
  • 1
    If you do this, will the domain admin be notified that this GPO application failed (s.t. they'd know to come after you)? Could it cause any cascading failures - e.g. it fails to process this one so it stops processing others? And how specifically do you block GPO from changing the keys - explicitly Deny 'Set Value', 'Write DAC', and 'Write Owner' to SYSTEM? or RESTRICTED? (I'm not sure which user these policies would be applied as...)
    – johnny
    Mar 26 '18 at 17:04
  • Event Logs indicate SYSTEM user is responsible...
    – johnny
    Mar 26 '18 at 17:16
  • @IceMage any thoughts/cautions/warnings here? Just noticed Knuckle-Dragger hasn't been seen 'round these parts since Aug 2015...
    – johnny
    Mar 26 '18 at 17:19
  • (sigh) Ice-Mage hasn't been around for ~1yr, so not sure that will help. @Keltari, you seem like you're still around - any thoughts on this 'solution'?
    – johnny
    Mar 26 '18 at 17:24
0

The only way to not receive updates from Group Policy is not to be part of the Domain, or to be in an excluded Organizational Unit.

Your "hacks" will continue to be overridden by Group Policy. Even changing the update interval should revert back to its previous setting on boot.

As mentioned in a comment, circumventing Group Policies is typically a violation of your companies acceptable computer use. Remember, the computer you are using isnt yours, its the companies.

5
  • totally agree. Many times, group policy is used to help enforce an overall computer security policy, especially for larger companies with tens or hundreds of thousands of computers in their environment. If you are making local GP changes that are contrary to the GP's being applied you are compromising the security of your computer. If you are at a smaller company and you happen to be the network admin, you can exclude computer/user accounts per group policy. I really suggest not playing around with fire like this, you are very likely going to be burned.
    – Richie086
    Mar 20 '14 at 14:27
  • 2
    In most cases I'd agree with you guys, except the fact that it's absolutely absurd that I cannot change the home page on Google Chrome and am forced to look at the corporate intranet page when I open the browser. Micro-management at it's best.
    – antonpug
    Mar 20 '14 at 14:39
  • 1
    Have you talked to you sysadmins? sometimes all you have to do is ask
    – Keltari
    Mar 20 '14 at 14:42
  • Chrome can take a URL as a parameter so one option for a custom home page is to add the URL to the chrome shorcut. Ex: Target C:\Users\JohnDoe\AppData\Local\Google\Chrome\Application\chrome.exe http:\\www.google.com
    – Brian
    Mar 20 '14 at 14:52
  • Right. Extensions are also disabled, home button is forced, and I can't use "sign in to chrome".
    – antonpug
    Mar 20 '14 at 15:06
0

I fully understand your pain, especially with everyone that is replying with "you shouldn't being do that" All you want is want an answer, not a moral lecture.

I recently started working for very large company that had a similar very ridiculous policy of not allowing you to continue where you left off in chrome and always forcing you to open the companies web page on startup.

Basically this prevents the vast majority of us from ever being able to restart our computers, because we would lose the 50 tabs we have open in chrome (if you are not one of those people that has that many tabs open, well good for you for having your job so sorted that you only ever have to work on one thing at a time and you always manage finish that before you move onto the next thing.)

Anyway, that's my rant done. Depending if you are local admin or not does restrict your options. One thing you can so is crash chrome instead of closing it or allowing windows to close it for you when restarting. To do this Windows+R then taskkill /f /im chrome.exe This command will force close all instances of chrome (ungracefully, not like clicking the X in the top right) Basically the same as the application crashing. Then when you relaunch chrome it will offer to restore tabs from before previous crash.

Other option is to create a text file put these lines in it [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] "RestoreOnStartup"=dword:00000001

Save it as whateveryouwanttocallit.reg

Then run this anytime before launching chrome and then when you close chrome it will automatically restart where you left off.

For every hack there is always a counter hack to bring you undone, like the domain admins pushing policy to prevent taskkill or regedit from working, but this might work for a while.

BTW: I'd also like to know what deny permission need to be set on a registry key to prevent them from being updated by domain group policies.

And if the company sacks you for trying to save time by trying to keep you browser tabs open, you are probably better off working for a different business.

Hope this helps the people that looking for answers and not moral advice. Cheers

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.