Okay.
So what I want to do now is illustrate some of these concepts around administrative template lockdown
that we just talked about.
So I've created a GPO linked to the marketing of you called Lockdown Policy, and I'm going to go ahead
and edit this GPO and I'm going to bring up the user side administrative templates, and I'm going to
do something simple.
I'm going to prevent access to the registry editing tools, in other words, registry, edit or reg
edit and I'm going to also disable reg it from running silently and I'm going to go ahead and enable
that policy.
Now what I'm going to do is come over to my client machine and go ahead and run a GP update.
Well, first I'm going to show you that.
Yes, indeed, registry editor runs.
And then I'm going to go ahead and come to the command prompt and issue a pop date on the user.
And we'll let that run to completion.
And what that's going to do is process that new registry, restriction policy registry ed restriction
policy such that now if I type right jetted you'll see here that I get the message registry editing
has been disabled by your administrator.
Great.
So essentially now that policy has been deployed to me and I'm now being affected by it.
I've essentially locked down from using the registry editor.
Now what I want to do is show you how if I come to this policy and essentially unlink it or disable
the link so this link is no longer valid within this O.U.
This marketing, oh, you come back to my client and again issue the update and now try to run registry
ed.
Sure enough, it comes up just fine.
And while I'm in Registry Editor, let's look at some of the policy areas that I talked about, those
keys.
So for example, here you'll see under each HQ, I underscore current underscore user backslash software,
backslash policies.
I've got a number of policies that have been delivered to me related to various admin templates, settings
that have been defined.
In this case, I have some internet settings that define cache properties.
I've got some power settings and I've got some app management settings.
And this particular one is the always download Missing Comm Components Policy Setting.
So kind of gives you an a little bit of an idea of how this works.
So what essentially happened with the registry editor is I applied the policy and it delivered a key
to one of these key y underscore current underscore user policy sub keys.
And then I unlinked the policy and did a pop date and it applied that or removed that registry editor
restriction that had previously applied.
And then essentially the registry editor was then available to me, as it always was, without the policy
in place.