Setting WMI and Registry permissions via GPO?

Hi,
I am configuring SCOM 2012 R2 for my environment. To configure it for SQL Serve,r I neeed to do the following:
Grant Read permission on HKLM:\Software\Microsoft\Microsoft SQL Server registry path for SQLDefaultAction and SQLMPLowPriv
Grant “Execute Methods”, “Enable Account”, “Remote Enable”, “Read Security” permissions for root, root\cimv2, root\default, root\Microsoft\SqlServer\ComputerManagement11 WMI namespaces to SQLDefaultAction and SQLMPLowPriv
Grant Read permission on HKLM:\Software\Microsoft\Microsoft SQL Server\[InstanceID]\MSSQLServer\Parameters registry path for SQLMPLowPriv for each monitored instance
So I need to assign registry permissions and wmi permissions.
Is there a way to do this via GPO?
Thanks

Hi,
You can not change the permission by using group policy directly.
Steps to solve your requirement,
1. Using the SetACL tool you can automate the management of Windows permissions. It is inherently automatable and scriptable. The
COM version provides the full functionality to any COM-enabled programming language (C#, Visual Basic, C++, Delphi, PowerShell, VBScript, …).
Supported object types: files and folders, registry keys, printers, services, network shares, WMI
So using this tool you can create script to automate Windows permissions.
2. Then you can use the created script as the Startup script in the GPO with privileges to allow the permission changes.
Checkout the below links on similar discussion,
http://social.technet.microsoft.com/Forums/windowsserver/en-US/87d4ed25-5247-41e4-8bb6-e29a078a1da0/change-permissions-for-a-specific-key?forum=winserverGP
http://social.technet.microsoft.com/Forums/en-US/c60ad5bb-309e-471d-9f48-e04e897ba61b/problems-setting-registry-permissions-via-gpo?forum=winserverGP
Regards,
Gopi
www.jijitechnologies.com

Similar Messages

How to Disable Usb Selective Suspend Setting For Windows 8.1 Via Gpo/Registry

Hello everyone,
Could help me with a question ?
How do I disable USB Seletive Suspended settings in Windows 8.1 is GPO / Registry ?

Good morning.
The procedure worked , sorry for the delay because the tests were running in the environment, will replicate via GPO solution.
I appreciate the help .

How to set NTFS and share permissions for Users share for home directories in Server 2012

I have a new Server 2012 server, and I want to set up a Users share, that will contain subfolders of each user's username and contain their home directory. But what do I set the share and NTFS permissions as on the root level, lets call the folder
Users? Is the following older article the correct permissions I need?
https://support.microsoft.com/kb/274443

Hi RJO22,
You can choose configure the Folder Redirection, Folder Redirection enables you to redirect the location of specific folders within user profiles to a new location, such as
a shared network location. Folder redirection is used in the process of administering user profiles and roaming user profiles. You can configure Folder Redirection using the Group Policy Management Console to redirect specific user profile folders, as well
as edit Folder Redirection policy settings.
The related KB:
Folder Redirection Overview
http://technet.microsoft.com/en-us/library/cc732275.aspx
Specify the Location of Folders in a User Profile
http://technet.microsoft.com/en-us/library/cc771969.aspx
I’m glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

How To Copy and run files Via GPO

HI All,
Our Domain got 300 PC's and UltraVNC is installed. Now i need to enable the MS Logon and add Security Groups.
I have export the VNC Ini file from Working computer.
also export the ACL into txt file
Exporting an ACL
MSLogonACL /e file (vnc.txt)
I have test by coping the ini file and run the ACL . Found All OK
MSLogonACL /i /a file
(vnc.txt)
"%ProgramFiles(x86)%\UltraVNC\MSLogonACL.exe" /i /o \\server\softwareshare\ultravncserver
\vnc.txt
So how do i do this via GPO?
AS

Hi,
I agree with Martin. We can run the script as a batch file. Before we deploy the script via group policy, we need to test it on a machine to see if it can run properly.
Besides, regarding how to utilize group policy to assign startup scripts, the following article can be referred to for more information.
Assign computer startup scripts
http://technet.microsoft.com/en-us/library/cc779329(v=WS.10).aspx
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
Best regards,
Frank Shen

Setting monitoring and SLA Alerts via Workspace studio

Hi,
Is it possible to set monitoring and SLA Alert rules via workspace studio. If yes, could you please help me how to do it.
Thanks
James

Hi..
Operational settings such as enabled, tracing, monitoring etc are easily set within eclipse by editing with the text editor rather than the proxy editor..
The SLA Alerts are possible to modify in the same way, but they're a bit more tricky to figure out..
..Mark.

ActiveX UAC and Proxy Settings via GPO

Hi there,
Wondering if anyone can help.
I am experiencing the following issue when trying to load ActiveX control without UAC prompts for standard users.
I have:
Configured ActiveXInstaller Service and configured allowed sites and settings via GPO.
Configured IE Security settings for the Trusted Zone to Allow ActiveX content to run via GPO.
Configured IE to use per user proxy settings via GPO.
Allowed the domain in our proxy and bypassed authentication for that domain.
Everything seems to be in place but I receive a UAC prompt for the Internet Explorer Add-on Installer UNLESS I either turn off the IE proxy settings or add the domain to the IE proxy exclusions list.
Unfortunately neither of these are options in our environment..
Anything I've missed?
Thanks!

Hi,
Before going further, what's the operating systems you are using? How did you configure
approved Installation Sites for ActiveX Controls and Active X installation policy for sites in Trusted zones settings?
Regarding how to configure these two settings, we can refer to the following article for double check.
Administering the ActiveX Installer Service in Windows 7
http://technet.microsoft.com/en-us/library/dd631688(v=ws.10).aspx
Besides, we can also run command gpresult/h gpreport.html with admin privileges to collect group policy result report to check if the policy settings are applied correctly.
Best regards,
Frank Shen

Connect Automatically setting, can it me enforced via GPO or registry setting?

Hello,
We have a number of Windows 8 and 8.1 tablets that use 3G to connect to our corp network. We woudl like to make sure this connection has the "Connect Automatically" setting enabled. I am using the Group Policy Manager on a Windows 2012
server and can't see tha tit can be changed, but does anyone know the registry path for this as I can then use the GPO to replace this setting?
Thanks

Hi,
You can use the software for 3G to connect automatically.
If you use a registry setting to enforce it ,you can use tool to caputre the key.
But we cannot connect automatically.
So,I suggest you use third-party software for 3G manufacturer.

Delegation and folder permissions via outlook

I've a question about delegation via outlook.
There are 2 different requests from our users:
1) share the mailbox for reading and writing. (without delegation)
2) delegate access to calendar without mail/contacts.
How is delegation working in Beehive?
I've found 2 ways of giving access to your mail:
1) set the permissions for a user on a folder by rightclicking on the folder. via permissions.
2) via tools/options/delegates.
What is the best way to give other users access to your mailfolder?
Thanks, Edward

To my knowledge, delegation is not in the user preferences, but can be found withing beehive central (e.g. http://myserver:myport/bcentral/action?page=delegation).
We tested that delegation successfully using the outlook client.
We would like to see an option to centrally administer such delegations: an employee that has fallen ill may contact the administrator, telling him: please allow my colleague ... to check my mail / have a look into my calender, without giving away his user credentials.
Regards, Thomas

What file/registry permissions are required to run MultiSim 7 as a regular user?

I want to be able to run MultiSim 7 as a regular user (since our students obviously do not have administrative permissions/rights).
I can't quite figure out what file and registry permissions are required to be able to do this (despite using Filemon and Regmon).

Hi,
If you are refering to the "failed to update registry" warning message, do this:
1. Click Start-->Run
2. Type "regedt32"
3. Locate HKEY_Classes_Root/Multisim.Document
4. On the menu, select Security-->Permission (win 2000), For XP select Edit-->Permission
5. Give full control for everyone
6. Repeat step 3-->5 for:
HKEY_Classes_Root/CLSID/{2D964073-9BC9-11D1-840B-006008AC6551}
Regards,
Tien Pham
EWB Support
Tien P.
National Instruments

Read and Write Permissions in Dreamweaver CS3

I have searhed the web endlessly for what seems like a simple question? How do you set read and write permissions for an upload folder in dreamweaver cs3?
I finally came accross one forum which described.
You go to the files panel and change the drop down menu from "Local View" to "Remote View".
Then you select the upload folder you created and right click on it.
A pop up menu appears and you select "set permissions"
This is where I am ok to. My defualt permissions are set to 666. Does anyone know the number to set it to if i would like visitors to my site to be able tp upload files?
ps I am using windows vista and dreamweaver cs3.

My defualt permissions are set to 666. Does anyone know the number to set it to if i would like visitors to my site to be able tp upload files?
Try 775 first, but you will probably need to use 777, which is the least secure set of permissions. Normally, if you want to allow people to upload to your website, you should create a login system and allow only registered users to upload to a folder that has permissions set to such a weak level. Otherwise, you could lay yourself open to all sorts of abuse.

Deploy an application shortcut (inside a network) via GPO

Hi,
I have the deploy printers, .msi applications and Internet shortcuts via GPO, but I'm having trouble with deploying an shortcut to a specific Computer or User. The shortcut contains a path UNC to an .exe file that will launch an application on a server.
I went through Group Policy Management, created a shortcut and edited all of the properties in the General tab to point to the .exe file within the server/folder. I followed a couple different screenshots off of forums and it looks correct, but it doesn't work. I also went the shortcut to a shared folder (that has the .exe file in it) and it still didn't work.
Any help would be much appreciated!
Seth
This topic first appeared in the Spiceworks Community

Hi,
I have the deploy printers, .msi applications and Internet shortcuts via GPO, but I'm having trouble with deploying an shortcut to a specific Computer or User. The shortcut contains a path UNC to an .exe file that will launch an application on a server.
I went through Group Policy Management, created a shortcut and edited all of the properties in the General tab to point to the .exe file within the server/folder. I followed a couple different screenshots off of forums and it looks correct, but it doesn't work. I also went the shortcut to a shared folder (that has the .exe file in it) and it still didn't work.
Any help would be much appreciated!
Seth
This topic first appeared in the Spiceworks Community

Activate Windows and Microsoft office with GPO

Dear
I Have Domain controller and clients connected to this domain also I have VDI connected to domain so I want to make windows and office activation Via GPO if it is possible so is there any solution for that
Best regards
Rawa Zangana

Hi Rawa,
>>so I want to make windows and office activation Via GPO if it is possible so is there any solution for that
As far as I know, Group Policy can’t help us activate software. To do this, we can resort to KMS or MAK for volume activation.
Regarding KMS and MAK, the following blog can be referred to for more information.
Volume Activation
http://blogs.technet.com/b/office2010/archive/2009/08/24/volume-activation.aspx
>>did I need to install volume activation Service on my domain controller
Regarding this point, I agree with Manjunath. This can reduce the workload of DC.
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
Best regards,
Frank Shen

Outlook 2013 set cached mode "Mail to keep offline" to All for existing Outlook profiles via GPO or registry changes

We recently migrated from Office 2010 to Office 2013. An annoying change is Outlook's "Use Cached Exchange Mode" setting that changes the previous setting of all email to partial email based on how old emails are. This is confusing
for end users because if they have a 1GB mailbox size limit and they look at the properties of their mailbox, it shows the cached amount which is always then less than the full amount. While they have a 1GB limit, the properties of their mailbox
might say 700MB because that's all that is cached, but meanwhile they can't send because they are actually over 1GB on the server side.
I want to set this cache setting to "All" for EXISTING profiles and new profiles. I think I can do it with GPO for new profiles, but I don't see a way to set it for existing profiles. I assume I have to do this with a registry setting.

Hi,
The cached mode Sync Slider setting is maintained in the Outlook profile settings in the Windows registry. If you want to administer this setting via group policy, you can use the group policy templates, which are available from the Microsoft Web site. The
group policy template files are Outlk15.admx and Outlk15.adml. If you use group policy to manage this setting, the following registry data is utilized by Outlook.
Key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Outlook\Cached Mode
DWORD: SyncWindowSetting
Value: integer value (Decimal) specifying the number of months (use only the following values)
0 = All (entire mailbox)
1 = One month of mailbox items
3 = three months of email items
6 = six months of email items
12 = twelve months of email items
24 = twenty-four months of email items
Refer from
http://support.microsoft.com/kb/2733062
Hope this will be helpful for you.

Error at RSOP while trying to set Audit settings via GPO

Hello,
i've configured Audit Policy via GPO and when i run RSOP on the server 2008 R2 i get X with the error "the policy engine did not attempt to configure the setting For more
information, see %windir%\security\logs\winlogon.log on the target machine.
Please help???

Hi,
This problem may occur if the "Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" policy setting is enabled. To resolve this issue, use one of the following methods, as appropriate for your situation.
Method 1: Disable the policy setting by using Group Policy Object Editor
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
Method 2: Disable the policy setting by using Registry Editor
Note: Please backup the registry key before modify.
1.Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA
2.Right-click SCENoApplyLegacyAuditPolicy, and then click Modify.
3.Type 0 in the Value data box, and then click OK.
Restart the computer after you make the change.
For more information, please refer to:
Security auditing settings are not applied to Windows Vista-based and Window Server 2008-based computers when you deploy a domain-based policy
http://support.microsoft.com/kb/921468/en-us
RSOP: the policy engine did not attempt to configure the setting
http://social.technet.microsoft.com/Forums/en-AU/winserverGP/thread/fde42cfc-bb74-4e11-8b60-c1a3cb5d80ed
If the problem still continues, please check the %windir%\security\logs\winlogon.log and reply the information in this log.
Regards,
Bruce

Set security preferences via GPO

Hi
Is there a way to set either security policy in Acrobat via GPO, so all a user would have to do is select:
Tools > Protection > Encrypt > select premade security policy (password protected)
Or a way to set the Adobe PDF printer preferences with Adobe PDF Security as 'Use the last known security preferences' with predefined settings via GPO.
We need to set up security on 100 or so acrobats and I am struggling to find a way to do this.
Thanks

Well if you can point me to this registry key i would appreciate it.
Applying the security settings via 'print to pdf' via gpo would be really handy right about now.
I managed to find a security file (security-policy.acrodata) that contains the details of security policies, I managed to copy this to another pc and the policy was displayed in adobe. However it doesn't save the password and a password must be entered manually.
Also I don't think the above would work for Acrobat 8 (we use both versions 8 and 10) and it doesn't make the security policy I create as the only favourited one as default.

Setting WMI and Registry permissions via GPO?

Similar Messages

Maybe you are looking for