DSC and HKCU?

JD 1 Reputation point
2022-12-23T23:35:38.327+00:00

Recently I started diving down the path of using DSC to simplify and automate STIG enforcement for a few environments I work on that are non-domain/closed network clients. As soon as I started scripting up PS1 scripts to generate and create MOF templates, I quickly ran in to the realization that DSC is not applying any HKCU elements. After a few hours of googling around I stumbled upon old posts and questions from various forums and here, discussing how DSC is not designed to interact with HKCU.

I was just wondering if there's any work in the pipeline to allow for DSC to control and enforce HKCU elements? As anyone who works with STIG's, you quickly realize how many of the registry keys you have to touch live exclusively in HKCU. Or has anyone figured out any workarounds to force HKCU elements through DSC? With Powershell not liking LGPO, and DSC not playing with the HKCU hive, it really seems like Microsoft does not like non-domain/closed network environments.

Windows Server Management
Windows Server Management
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Management: The act or process of organizing, handling, directing or controlling something.
449 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,627 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. M. Jenne 75 Reputation points
    2023-01-25T05:39:33.0533333+00:00

    DSC can be used for HKCU, you just need to write a DSC resource to do it, meaning the default registry resource can't do what you need to do.

    You could create a script-based DSC resource that performs the actions that you need to, which is basically enumerate users on the system, load their hive and make the changes you need to make. That sounds complicated, but taken one step at a time is doable.

    MJ

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.