1

What I need to do is to modify local group policy and local security policy on different machine.It is very inconvenient to modify them each item, so I want to find out any way that can modify them through programming. I have tried the way in this website,but it didn't work. What I need to modify are shown as below:

1.Launch the Local/Group Policy Editor.

  • Disable Windows update option at shutdown Go to Computer Configuration -> Administrative Templates -> Windows Components -> Windows Updates, and double click on Windows Updates.

    set "Do not display 'Install Updates and Shut Down'" to Enable.

  • Set "Display Shutdown Event Tracker" in Group Policy Editor to Disabled.

    Computer Configuration->Administrative Templates->System. Set "Display Shutdown Event Tracker" to Disabled.

  • Computer Configuration->Windows Settings->Security Settings->Local Policies->Security Options.

    Set the group policy option "Shutdown: Allow system to be shut down without having to log on" to Disabled.

2.Launch the Local Security Policy(run secpol.msc).

  • Security Settings->Local Policies->Security Options.

    Set the “Interactive logon: Do not display last username" option to Enabled.

  • Security Settings->Local Policies->User Rights Assignment.

    Add the user Administrator to "Deny logon through terminal services".

  • Security Settings->Account Policies > Password Policy

    Set the "Password must meet complexity requirements"

By the way, the windows operation is Windows server 2008r2 and windows server 2012r2.

ssss4world
  • 31
  • 1
  • 5
  • The "User Rights Assignment" change *might* need to be handled in a different way. If you run into trouble with that in particular, you should probably post it as a separate question. (Check for existing questions first, this might have already been answered.) – Harry Johnston Nov 03 '16 at 22:49

2 Answers2

0

PowerShell offers cmdlets to administer Group Policy. However, you normally don't need to modify local group policies on each machine. Just create a GPO and link it to the required computers.

bahrep
  • 29,961
  • 12
  • 103
  • 150
  • I don't think those cmdlets work for local group policy. (I agree that local group policy is probably the wrong way to do it!) – Harry Johnston Nov 03 '16 at 22:40
0

There are very few things you can do programatically with settings in Group Policy. Administrative template settings, or any 'registry' data is within reach with the PowerShell cmdlets provided for set-gpregistryvalue and set-gpprefregistryvalue. You can reverse engineer the storage of each policy area and the general GP storage of each area but that is a bit of a chore unless you are an ISV looking to build tools. There is currently only 1 real interface available to read and write settings to GPOs. (full disclosure I am with the company that provides the solution). Google 'Group Policy Automation' and you will find it.

On another note, managing local policy is still a very important task for many reasons. Non domain joined systems, isolated systems, compliance between domain joined and non-domina joined boxes... lots of scenarios where this is important and necessary. Not to mention Windows Nano server.

so, I guess it depends on how deep you need to go or what your task is. If you are looking to build commercial solutions built on Group Policy start at MDSN (https://msdn.microsoft.com/en-us/library/windows/desktop/aa374177(v=vs.85).aspx). If you are looking for something simpler but third party let me know. If you are looking to manage just registry data look into the PowerShell cmdlets.

Kevin
  • 46
  • 1