How to disable group policy
dan
-
philcot -
philcot -
Hello,
I have a problem, I wanted to restore my system to a specific date because several desktop.ini files keep appearing everywhere and since I don't know much about it, it worried me. However, when I did it, after rebooting the computer, it tells me: "the restoration could not take place due to an unspecified error."
Additionally, in the system protection command, it says "creation of restore points disabled by group policy."
I don't quite understand what a group policy is, and I don't see what I could have done to enable it. I think there's a good chance all these problems are related.
I am using Windows Vista and I have Norton 360 and Windows Defender.
I don't know if it's serious or if it's normal, and I would like to get your opinions. And if possible, I'd like to know how to disable this group policy.
Can you please help me?
Thanks in advance.
I have a problem, I wanted to restore my system to a specific date because several desktop.ini files keep appearing everywhere and since I don't know much about it, it worried me. However, when I did it, after rebooting the computer, it tells me: "the restoration could not take place due to an unspecified error."
Additionally, in the system protection command, it says "creation of restore points disabled by group policy."
I don't quite understand what a group policy is, and I don't see what I could have done to enable it. I think there's a good chance all these problems are related.
I am using Windows Vista and I have Norton 360 and Windows Defender.
I don't know if it's serious or if it's normal, and I would like to get your opinions. And if possible, I'd like to know how to disable this group policy.
Can you please help me?
Thanks in advance.
Configuration: Windows Vista Internet Explorer 7.0
19 réponses
A strategy is used to implement one or more usage restrictions for Windows and its main components.
There are 2 types: machine-related restrictions (the computer) and user-related restrictions (users).
One important thing to know is that modifying a user policy will be applied to ALL user accounts on the computer, including administrators.
Therefore, the haphazard definition of an overly restrictive policy can prove to be annoying or even catastrophic for the rights to configure the computer and its software. However, a small trick allows you to apply these policies to specific accounts without affecting the administrator account(s).
It should be noted that as long as policies are applied, 2 system files are created (and thus read!)
- at computer startup (c:\windows\system32\GroupPolicy\machine\Registry.pol
- at user login (c:\windows\system32\GroupPolicy\user\Registry.pol)
----> These 2 files correspond to keys in the registry that apply the configured restrictions. Therefore, manually changing some of these keys will result in those modifications being undone at the next reboot of the computer or user session.
If you want to regain all rights without restrictions for your administrator account, simply delete these 2 files, and you will never have a single restriction again (I remind you that modifying a user policy will be applied to ALL users, and thus the restrictions on the younger sister's account will also have all the rights as much as the administrator, which can be problematic. The workaround, to have an administrator account with all rights without touching the restrictions of the other accounts, is as follows:
The strategies defined using GPEDIT apply to all users, including administrators, which can be very troublesome!
Here's a method to remedy this issue:
1. Log in as an administrator.
2. Launch GPEDIT.MSC, and define the desired policies (being careful, however, so that later one does not find oneself in a situation of total blockage. For example, access to MMC.EXE should in no case be prohibited!).
3. Exit GPEDIT.
4. Log off.
5. Repeat the following sequence for ALL accounts (including the administrator):
1. Log in.
In fact, logging in triggers the application of policies (and conversely, as long as an account has not logged in, the policies are not yet applied).
2. Log off
6. Log in as an administrator.
7. Copy the file %Systemroot%\System32\GroupPolicy\User\Registry.pol to any folder (another partition, floppy disk, ...).
8. Restart GPEDIT.MSC, and cancel the policies defined in point 2 that you do not want to apply to the administrator accounts.
9. Exit GPEDIT
10. Copy the Registry.pol backup file from point 7 to the %Systemroot%\System32\GroupPolicy\User folder. This operation will overwrite the file created when disabling the policies in point 8. If the system asks for confirmation to replace the existing file, respond Yes.
11. Log off.
12. Log in as an administrator. The policies defined in point 2 are not applied.
13. Log off.
14. Log in as a regular user. The policies defined in point 2 are applied.
For your information, GPEDIT manages the keys
for users
* HKEY_CURRENT_USER\Software\Policies\Microsoft
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
for the computer (the machine)
* HKEY_LOCAL_MACHINE\Software\Policies\Microsoft
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies
There you go, folks.. I hope this will help you because everything that touches closely or distantly on account restrictions is where it happens and nowhere else!!
"To see far, you have to look closely" (Pierre Dac)
There are 2 types: machine-related restrictions (the computer) and user-related restrictions (users).
One important thing to know is that modifying a user policy will be applied to ALL user accounts on the computer, including administrators.
Therefore, the haphazard definition of an overly restrictive policy can prove to be annoying or even catastrophic for the rights to configure the computer and its software. However, a small trick allows you to apply these policies to specific accounts without affecting the administrator account(s).
It should be noted that as long as policies are applied, 2 system files are created (and thus read!)
- at computer startup (c:\windows\system32\GroupPolicy\machine\Registry.pol
- at user login (c:\windows\system32\GroupPolicy\user\Registry.pol)
----> These 2 files correspond to keys in the registry that apply the configured restrictions. Therefore, manually changing some of these keys will result in those modifications being undone at the next reboot of the computer or user session.
If you want to regain all rights without restrictions for your administrator account, simply delete these 2 files, and you will never have a single restriction again (I remind you that modifying a user policy will be applied to ALL users, and thus the restrictions on the younger sister's account will also have all the rights as much as the administrator, which can be problematic. The workaround, to have an administrator account with all rights without touching the restrictions of the other accounts, is as follows:
The strategies defined using GPEDIT apply to all users, including administrators, which can be very troublesome!
Here's a method to remedy this issue:
1. Log in as an administrator.
2. Launch GPEDIT.MSC, and define the desired policies (being careful, however, so that later one does not find oneself in a situation of total blockage. For example, access to MMC.EXE should in no case be prohibited!).
3. Exit GPEDIT.
4. Log off.
5. Repeat the following sequence for ALL accounts (including the administrator):
1. Log in.
In fact, logging in triggers the application of policies (and conversely, as long as an account has not logged in, the policies are not yet applied).
2. Log off
6. Log in as an administrator.
7. Copy the file %Systemroot%\System32\GroupPolicy\User\Registry.pol to any folder (another partition, floppy disk, ...).
8. Restart GPEDIT.MSC, and cancel the policies defined in point 2 that you do not want to apply to the administrator accounts.
9. Exit GPEDIT
10. Copy the Registry.pol backup file from point 7 to the %Systemroot%\System32\GroupPolicy\User folder. This operation will overwrite the file created when disabling the policies in point 8. If the system asks for confirmation to replace the existing file, respond Yes.
11. Log off.
12. Log in as an administrator. The policies defined in point 2 are not applied.
13. Log off.
14. Log in as a regular user. The policies defined in point 2 are applied.
For your information, GPEDIT manages the keys
for users
* HKEY_CURRENT_USER\Software\Policies\Microsoft
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
for the computer (the machine)
* HKEY_LOCAL_MACHINE\Software\Policies\Microsoft
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies
There you go, folks.. I hope this will help you because everything that touches closely or distantly on account restrictions is where it happens and nowhere else!!
"To see far, you have to look closely" (Pierre Dac)
I am on Vista, and I can't do anything when I run GPEDIT.MSC
my problem: failed to connect to a Windows service: Windows could not connect to the group policy client service...
Best regards
Bruno
I still can't launch gpedit.msc, even after modifying value 3 in the hklm registry...