Remote Reg Editing

[Boxalld]

Guys,
Were currently putting together a GPO to lock down a bunch of servers. Currently the design is to lock down the reg and open up where needed. A suggestion was made to unlock reg and stop the regedit and regedt32 tools from working, however this was done and people could still connect remotely to the reg and edit it...

Is there a way to keep the reg open and stop people from attaching remotely and editing the reg????

 

[itsp1965]

Have you tried disabling the Remote Registry service (it can be set in group policy). This will disable users ability to remotely connect to registries on other machines. Hope this helps.

 

[Boxalld]

Will this not cause problems with apps ????

 

[itsp1965]

Has no bearing on apps. If you read the description, if this service is stopped only users local to the machine can modify the registry and not remote users.

 

[porkchopexpress]

That isn't strictly true and you will need to test this. Any utilities that you use to collect remote configuration information 'may' not work. We found that Netdiag didn't work and we couldn't remotly deploy the Netsupport RDP package after disabling this service.





When you are the IT director, it's your job to make sure the IT works. If it does work they know already and if it doesn't, they don't want to hear your pathetic excuses.

 

[itsp1965]

If you are deploying a package, it should be able to run with administrative privileges on the machine that it's being pushed to and the registry changes as far as I know are being run local to the machine (and not remotely)
I haven't run a test with Netdiag, but it sounds strange that disabling Remote Registry would have a bearing on successfully running this util.
I'll concur with porkchopexpress, the only way to know is to test it in your environment.

 

[porkchopexpress]

Netsupport a bit like some versions of VNC are deployed on demand via RPC they aren't packages that are deployed by GPO they seem to require remote registry. I took me a while to figure that out as i didn't use them for a while after disabling the service.

Most things should continue to work just fine.





When you are the IT director, it's your job to make sure the IT works. If it does work they know already and if it doesn't, they don't want to hear your pathetic excuses.