[gptalk] Re: Problem implementing a registry setting in ADM

  • From: victor-w@xxxxxxxxx
  • To: gptalk@xxxxxxxxxxxxx
  • Date: Fri, 27 Oct 2006 10:39:13 +0200

Alan, 

Thanks for testing this.

If I understand it right you you mean by KEYVALUE the same as VALUENAME.
The VALUENAME is "DisablePST" and this is what should be deleted.


Cheers,


Victor

 

----- Oorspronkelijk bericht -----
Van: Alan & Margaret <syspro@xxxxxxxxxxxxxxxx>
Datum: donderdag, oktober 26, 2006 11:38 pm
Onderwerp: [gptalk] Re: Problem implementing a registry setting in ADM

> Darren,
> 
> 
> 
> How embarrassing. Based on your question I went back and tested 
> all of the
> parts and found that CHECKBOX actually uses the VALUEOFF setting 
> when the
> Policy is disabled, but all of the other parts (TEXTBOX, NUMERIC, 
> LISTBOX,DROPDOWNLIST) all delete the values when the policy is 
> disabled. I suppose
> this is logical.
> 
> 
> 
> Based on this Victor, the checkbox won't do what you want, but the
> DROPDOWNLIST will. (Note: I am assuming you mean you want the KEYVALUE
> deleted when the policy is set to Disabled, rather than the KEY 
> itself being
> deleted.)
> 
> 
> 
> Alan Cuthbertson
> 
> 
> 
> 
> 
> Policy Management Software:-
> 
> http://www.sysprosoft.com/index.php?ref=activedir
> <http://www.sysprosoft.com/index.php?
ref=activedir&f=pol_summary.shtml>
> &f=pol_summary.shtml
> 
> 
> 
> ADM Template Editor:-
> 
> http://www.sysprosoft.com/index.php?ref=activedir
> <http://www.sysprosoft.com/index.php?
ref=activedir&f=adm_summary.shtml>
> &f=adm_summary.shtml
> 
> 
> 
> Policy Log Reporter(Free)
> 
> http://www.sysprosoft.com/index.php?ref=activedir
> <http://www.sysprosoft.com/index.php?
ref=activedir&f=policyreporter.shtml>
> &f=policyreporter.shtml
> 
> 
> 
> 
> 
> 
> 
>  _____  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-
> bounce@xxxxxxxxxxxxx] On
> Behalf Of Victor W.
> Sent: Friday, 27 October 2006 5:31 AM
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> 
> 
> It seems I have raised a question to which the answer turns out to 
> be not as
> simple as I thought. :-)
> 
> 
> 
> Maybe I want two things in the same policy that aren't possible 
> together.
> 
> 
> On the one hand I want the registry key to be deleted when the GPO 
> is set to
> Disabled.
> 
> On the other hand I want the resgistry key to be set to 0 when it 
> is set to
> Enabled and No is selected.
> 
> 
> 
> I am still hoping this is possible somehow.
> 
> 
> 
> Thanks,
> 
> 
> 
> 
> 
> Victor
> 
> 
> 
> 
> 
> 
> 
> 
> 
>  _____  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-
> bounce@xxxxxxxxxxxxx] On
> Behalf Of Darren Mar-Elia
> Sent: donderdag 26 oktober 2006 15:35
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> Alan-
> 
> I haven't looked at the checkbox part in particular so you may be 
> right, but
> in general, that is not the way a "regular" policy behaves. Do you 
> know if
> the Dropdownlist part behaves the same way?
> 
> 
> Thanks
> 
> 
> Darren
> 
> 
> 
>  _____  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-
> bounce@xxxxxxxxxxxxx] On
> Behalf Of Alan & Margaret
> Sent: Wednesday, October 25, 2006 9:28 PM
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> Hi Darren,
> 
> 
> 
> I think you are mistaken (or I have misunderstood you)
> 
> 
> 
> You are correct when you define a POLICY. You normally assign a 
> registryvalue to it and you can define a VALUEON and VALUEOFF. 
> These can be a value,
> or can use the DELETE keyword. (Microsoft uses a Default of DELETE for
> VALUEOFF )
> 
> 
> 
> However a CHECKBOX PART within a POLICY behaves differently. It 
> has a
> VALUEON and VALUEOFF parameter, but it also has a DELETE setting 
> which comes
> in to effect if the Policy is disabled: effectively this is a Tri-
> state:-
> 
> 
> 
> 1.       Policy Enabled, CheckBox Enabled = VALUEON setting
> 
> 2.       Policy Enabled, CheckBox disabled = VALUEOFF setting
> 
> 3.       Policy Disabled = DELETE
> 
> 
> 
> This can lead to  confusion if you set the VALUEOFF parameter to 
> be DELETE.
> If it is the only PART in the Policy, and there is no keyValue 
> defined for
> the Policy, then the Group Policy Editor uses the setting to determine
> whether the policy is enabled. This means that you can:-
> 
> 1.       Enable the policy
> 
> 2.       Uncheck the check Box
> 
> 3.       Save the policy
> 
> 4.       The policy shows as Disabled (rather than enabled)
> 
> 
> 
> Sounds a bit silly, but if you use the following, it is exactly 
> what happens
> 
> 
> 
> CLASS MACHINE
> 
> CLASS USER
> 
>            CATEGORY "Test Policy"
> 
>                        POLICY "Test CheckBox"
> 
>                                    KEYNAME software\test\checkbox
> 
> 
> 
>                                    PART test CHECKBOX
> 
>                                                KEYNAME
> software\test\checkbox
> 
>                                                VALUENAME CheckBox
> 
>                                                VALUEON 1
> 
>                                                VALUEOFF DELETE
> 
>                                    END PART ;test
> 
>                        END POLICY ;Test CheckBox
> 
>            END CATEGORY ;Test Policy
> 
> [Strings]
> 
> 
> 
> 
> 
> 
> 
>  _____  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-
> bounce@xxxxxxxxxxxxx] On
> Behalf Of Darren Mar-Elia
> Sent: Thursday, 26 October 2006 11:31 AM
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> 
> 
> Oops. Sorry, hit send to fast:
> 
> This:
> 
> 'Disabled'              - the registry setting must not be there
> 
> 
> 
> Is problematic. The Disabled state will always set a value--it 
> will not
> delete a value by default. There is the Delete keyword that you 
> can use
> however, in the ADM syntax. That might get you what you need.
> 
> 
> Darren
> 
>  _____  
> 
> From: Darren Mar-Elia [mailto:darren@xxxxxxxxxx] 
> Sent: Wednesday, October 25, 2006 6:29 PM
> To: 'gptalk@xxxxxxxxxxxxx'
> Subject: RE: [gptalk] Re: Problem implementing a registry setting 
> in ADM
> 
> The only thing I'll add to Alan's comments Victor is that I think 
> you will
> have problems with the following that you wrote:
> 
> 
> 
> 
> 
>  _____  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-
> bounce@xxxxxxxxxxxxx] On
> Behalf Of Alan & Margaret
> Sent: Wednesday, October 25, 2006 5:59 PM
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> Hi Victor,
> 
> 
> 
> You are pretty well correct with what you have written. 
> 
> 
> 
> One thing that is a little confusing is whether you want a Tri-
> state (i.e.
> Missing, 1, or 0) setting or a Bi-state setting (1, 0). I suspect 
> a Bi-state
> setting since the application will normally treat a "missing" as "0".
> 
> 
> 
> If you want a tristate setting, then you can do it as a checkbox 
> or a
> Listbox within a Policy and it will behave as you wish
> 
> 
> 
> If you want a Bi state , then you can do it just as a Policy
> 
> 
> 
> One other point, "Not configured" always means "do nothing" It has 
> to be
> this way otherwise all of the polices that you don't configure 
> would be
> removing entries on you
> 
> 
> 
> 
> 
> Alan Cuthbertson
> 
> 
> 
> 
> 
> Policy Management Software:-
> 
> http://www.sysprosoft.com/index.php?ref=activedir
> <http://www.sysprosoft.com/index.php?
ref=activedir&f=pol_summary.shtml>
> &f=pol_summary.shtml
> 
> 
> 
> ADM Template Editor:-
> 
> http://www.sysprosoft.com/index.php?ref=activedir
> <http://www.sysprosoft.com/index.php?
ref=activedir&f=adm_summary.shtml>
> &f=adm_summary.shtml
> 
> 
> 
> Policy Log Reporter(Free)
> 
> http://www.sysprosoft.com/index.php?ref=activedir
> <http://www.sysprosoft.com/index.php?
ref=activedir&f=policyreporter.shtml>
> &f=policyreporter.shtml
> 
> 
> 
> 
> 
>  _____  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-
> bounce@xxxxxxxxxxxxx] On
> Behalf Of Victor W.
> Sent: Thursday, 26 October 2006 5:43 AM
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> 
> 
> Hi,
> 
> 
> 
> I have decided to implement it with the drop down list afterall. 
> 
> This is because this way there is probably less confusion when 
> somebodyselects "enable".
> 
> He then has two choices Yes and No, I know this is confusing but 
> probablyless confusing then with the checkbox.
> 
> 
> 
> But it got me thinking about the whole matter and that was a good 
> thing.
> 
> 
> I would like to go through the ADM file to be sure I am correct in my
> assumption:
> 
> 
> 
> What I would like the following to mean in the GPO is:
> 
> 
> 
> 'Not Configured'     - the registry setting must not be there
> 
> 'Enabled'               - the registry setting must be there with 
> a value of
> 1
> 
> 'Disabled'              - the registry setting must not be there
> 
> 
> 
> 
> 
> When Enabled has been selected and Yes is selected in the drop 
> downlist -
> the registry setting must be there with a value of 1
> 
> When Enabled has been selected and No is selected in the drop 
> downlist - the
> registry setting must be there with a value of 0
> 
> 
> 
> Is all the above possible?
> 
> 
> 
> 
> 
> Below is the adm file as it is now (I have put a lot of spaces in 
> a part
> section, this can also probably be done otherwise).
> 
> 
> 
> 
> 
> CLASS MACHINE
> 
> CATEGORY "Office Components"
> 
>           POLICY "PST Restrictions"
> 
>           KEYNAME "SOFTWARE\Microsoft\Office\11.0\Outlook"
> 
>                        PART "This setting restricts the use of 
> PST files."
> TEXT
> 
>                        END PART
> 
> 
> 
> PART "
> "
> 
> TEXT
> 
> END PART
> 
> PART "Restrict PST files" DROPDOWNLIST
> 
>    VALUENAME DisablePST
> 
>            ITEMLIST
> 
>            NAME "Yes" VALUE NUMERIC 1 DEFAULT
> 
>            NAME "No" VALUE NUMERIC 0 
> 
>            END ITEMLIST
> 
>                        END PART
> 
>            END POLICY
> 
> END CATEGORY
> 
> 
> 
> Cheers,
> 
> 
> 
> 
> 
> Victor
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
>  _____  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-
> bounce@xxxxxxxxxxxxx] On
> Behalf Of Victor W.
> Sent: zondag 22 oktober 2006 11:19
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> Hi Alan,
> 
> 
> 
> Great work. I will implement it this way and offcourse will take a 
> look at
> the tool you suggested ;-)
> 
> 
> 
> Cheers,
> 
> 
> 
> 
> 
> Victor
> 
> 
> 
>  _____  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-
> bounce@xxxxxxxxxxxxx] On
> Behalf Of Alan & Margaret
> Sent: donderdag 19 oktober 2006 23:59
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> Hi Victor,
> 
> 
> 
> You are correct that the problem is in your  ItemList. The parts 
> in bold are
> not valid:-
> 
> 
> 
> ITEMLIST
> NAME "Yes" VALUE Numeric 1
> VALUE NUMERIC 1 DEFAULT
> NAME "No" VALUE Numeric 0
> VALUE NUMERIC 0 
> END ITEMLIST
> 
> An item list is a list of options. Each option must have a NAME 
> and a VALUE.
> You can have other keywords such as Numeric and Default.
> 
> 
> 
> Note: You don't really need to use an item List. A checkbox would 
> be simpler
> since it gives you an effective Yes/No value:-
> 
> 
> 
>   PART "Restrict pst files" CHECKBOX
>    KEYNAME SOFTWARE\Microsoft\Office\11.0\Outlook
>    VALUENAME DisablePST
>    VALUEON NUMERIC 1
>    VALUEOFF NUMERIC 0
>   END PART ;Restrict pst files
> 
> Note: At the risk of incurring the rage of list members, you 
> should consider
> using an ADM Editor tool (we sell one). If nothing else, download 
> it and
> play with it for a month and you will learn a lot about writing 
> your own ADM
> files!
> 
> 
> 
> Alan Cuthbertson
> 
> 
> Policy Management Software:-
> http://www.sysprosoft.com/index.php?ref=activedir&f=pol_summary.shtml
> ADM Template Editor:-
> http://www.sysprosoft.com/index.php?ref=activedir&f=adm_summary.shtml
> Policy Log Reporter(Free)
> 
> <http://www.sysprosoft.com/index.php?
ref=activedir&f=policyreporter.shtml>http://www.sysprosoft.com/index.php
?ref=activedir&f=policyreporter.shtml
> 
> 
> 
> ----- Original Message ----- 
> 
> From: "Victor W." < <mailto:victor-w@xxxxxxxxx> victor-w@xxxxxxxxx>
> 
> To: < <mailto:gptalk@xxxxxxxxxxxxx> gptalk@xxxxxxxxxxxxx>
> 
> Sent: Friday, October 20, 2006 7:08 AM
> 
> Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> 
> 
> 
> > 
> > I managed to get it working, see below.
> > It seems as if the Yes and No checkboxes dont go together with 
> the VALEUON
> > NUMERIC 1 and the VALUEOFF NUMERIC 0.
> > Am I correct in my assumption?
> > 
> > CLASS MACHINE
> > CATEGORY "Custom ADM Entries"
> > POLICY "PST Restrictions"
> > KEYNAME "SOFTWARE\Microsoft\Office\11.0\Outlook"
> > PART "This setting restricts the use of PST files. Sander
> > asks waarom?" TEXT
> > END PART
> > PART "Do you want to restrict PST files?" DROPDOWNLIST
> > VALUENAME "DisablePST"
> > ITEMLIST
> > NAME "Yes" VALUE Numeric 1
> > DEFAULT
> > NAME "No" VALUE Numeric 0
> >  END ITEMLIST
> > END PART
> > END POLICY
> > END CATEGORY
> > 
> > 
> > 
> > 
> > 
> > -----Original Message-----
> > From:  <mailto:gptalk-bounce@xxxxxxxxxxxxx> gptalk-
> bounce@xxxxxxxxxxxxx[mailto:gptalk-bounce@xxxxxxxxxxxxx] On
> > Behalf Of Victor W.
> > Sent: donderdag 19 oktober 2006 22:33
> > To:  <mailto:gptalk@xxxxxxxxxxxxx> gptalk@xxxxxxxxxxxxx
> > Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> > 
> > Thanks, that did it.
> > 
> > I now changed the adm file a bit and now it looks like this, but 
> it gives
> me
> > an error when I add it.
> > 
> > CLASS MACHINE
> > CATEGORY "Custom ADM Entries"
> > POLICY "PST Restrictions"
> > KEYNAME "SOFTWARE\Microsoft\Office\11.0\Outlook"
> > VALUENAME "DisablePST"
> > VALUEON NUMERIC 1
> > VALUEOFF NUMERIC 0
> > 
> > PART "Restricting the use of PST files" TEXT
> > END PART
> > 
> > PART "I want to restrict PST files" DROPDOWNLIST
> > 
> > ITEMLIST
> > NAME "Yes" VALUE Numeric 1
> > VALUE NUMERIC 1 DEFAULT
> > NAME "No" VALUE Numeric 0
> > VALUE NUMERIC 0 
> > END ITEMLIST
> > END PART
> > END POLICY
> > END CATEGORY
> > 
> > It gives me the error that line 21 has no value.
> > 
> > Anybody familiar with this?
> > 
> > Cheers,
> > 
> > 
> > Victor
> > 
> > 
> > 
> > -----Original Message-----
> > From:  <mailto:gptalk-bounce@xxxxxxxxxxxxx> gptalk-
> bounce@xxxxxxxxxxxxx[mailto:gptalk-bounce@xxxxxxxxxxxxx] On
> > Behalf Of Robert Tannehill
> > Sent: donderdag 19 oktober 2006 17:00
> > To:  <mailto:gptalk@xxxxxxxxxxxxx> gptalk@xxxxxxxxxxxxx
> > Subject: [gptalk] Re: Problem implementing a registry setting in ADM
> > 
> > Victor,
> > Make sure on the GPMC, you set View, Filtering, Only show policy 
> settings> that can be fully managed to Unchecked.
> > Bob 
> > 
> > -----Original Message-----
> > From:  <mailto:gptalk-bounce@xxxxxxxxxxxxx> gptalk-
> bounce@xxxxxxxxxxxxx[mailto:gptalk-bounce@xxxxxxxxxxxxx] On
> > Behalf Of  <mailto:victor-w@xxxxxxxxx> victor-w@xxxxxxxxx
> > Sent: Thursday, October 19, 2006 8:49 AM
> > To:  <mailto:gptalk@xxxxxxxxxxxxx> gptalk@xxxxxxxxxxxxx
> > Subject: [gptalk] Problem implementing a registry setting in ADM
> > 
> > Gents and ladies,
> > 
> > I am trying to implement the following registry setting in an 
> ADM file but
> > it simply doenst show up in the GPO editor/GPMC.
> > 
> > [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Outlook]
> > "DisablePST"=dword:00000001
> > 
> > The folder itself (Custom ADM Entries), does appear but the 
> setting simply
> > isnt there.
> > Am I missing something? I sure must be :-)
> > 
> > I this setting I would also like to implement the VALUEON 
> NUMERIC 1 and
> the
> > VALUEON NUMERIC 0. So that the setting is not deleted when choosing
> disable.
> > 
> > Any suggestions are greatly appreciated.
> > 
> > See the adm file below.
> > 
> > Cheers,
> > 
> > 
> > Victor
> > 
> > 
> > CLASS MACHINE
> > CATEGORY "Custom ADM Entries"
> > POLICY "PST Restrictions"
> > KEYNAME "SOFTWARE\Microsoft\Office\11.0\Outlook"
> > PART "Do you want to restrict PST files?" TEXT
> > END PART
> > PART "I want to restrict PST files" DROPDOWNLIST
> > VALUENAME DisablePST
> > ITEMLIST
> > NAME "Yes" VALUE Numeric 1
> > NAME "No" VALUE Numeric 0
> > END ITEMLIST
> > END PART
> > END POLICY
> > END CATEGORY
> > 
> > ***********************
> > You can unsubscribe from gptalk by sending email to
> >  <mailto:gptalk-request@xxxxxxxxxxxxx> gptalk-
> request@xxxxxxxxxxxxx with
> 'unsubscribe' in the Subject field OR by
> > logging into the freelists.org Web interface. Archives for the 
> list are
> > available at  <http://www.freelists.org/archives/gptalk/>
> http://www.freelists.org/archives/gptalk/
> > ************************
> > ***********************
> > You can unsubscribe from gptalk by sending email to
> >  <mailto:gptalk-request@xxxxxxxxxxxxx> gptalk-
> request@xxxxxxxxxxxxx with
> 'unsubscribe' in the Subject field OR by
> > logging into the freelists.org Web interface. Archives for the 
> list are
> > available at  <http://www.freelists.org/archives/gptalk/>
> http://www.freelists.org/archives/gptalk/
> > ************************
> > 
> > ***********************
> > You can unsubscribe from gptalk by sending email to
> >  <mailto:gptalk-request@xxxxxxxxxxxxx> gptalk-
> request@xxxxxxxxxxxxx with
> 'unsubscribe' in the Subject field OR by
> > logging into the freelists.org Web interface. Archives for the 
> list are
> > available at  <http://www.freelists.org/archives/gptalk/>
> http://www.freelists.org/archives/gptalk/
> > ************************
> > 
> > ***********************
> > You can unsubscribe from gptalk by sending email to
> <mailto:gptalk-request@xxxxxxxxxxxxx> gptalk-request@xxxxxxxxxxxxx 
> with'unsubscribe' in the Subject field OR by logging into the 
> freelists.org Web
> interface. Archives for the list are available at
> <http://www.freelists.org/archives/gptalk/>
> http://www.freelists.org/archives/gptalk/
> > ************************ 
> 
> 
***********************
You can unsubscribe from gptalk by sending email to 
gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR by 
logging into the freelists.org Web interface. Archives for the list are 
available at http://www.freelists.org/archives/gptalk/
************************

Other related posts: