Changing attributes for C:\windows\Fonts directory through GPO

Question

Hi,
It has been some time that I am trying to deploy a family of fonts to all our systems. I should do 2 things to fulfill this. First I need to copy the fonts into the %windir%\Fonts and then add the registry values.

I have been trying for some time and have not been able to copy the files into the Fonts Directory, and then I figured out that it is because of the security attributes on that specific directory, so I changed the attributes locally using the command line and this command attrib -r -s C:\Windows\Fonts, and then I was able to copy the fonts into the Fonts directory. Then I wanted to also change the attributes with the same GPO, so I created an startup and logon script, both with Computer Configuration, and also with User Configuration, but still I got nothing.

So now the question is how can I change the attributes on that specific (C:\Windows\Fonts) directory.

Any Help would be appreciated!

Answer 1

You really shouldn't be adding fonts to that directory directly. Fonts need to be installed on the system. That involves more than just copying files. You should install the fonts onto the machine using the normal process. This eliminates your issues. To do that you would create a logon script. One example of this is provided here.

If you really, really need to use GPO to do that then you shouldn't need to change the permissions on the folder. More specifically you should never change the permissions on the folder using GPO and then fail to set the permissions back. If you do then you are potentially exposing the machines to malicious use as other users can now modify that directory as well. To test locally you would need to elevate your permissions when copying the files but this shouldn't be an issue if you're using GPO as it is already running at the appropriate permissions. But, again, I would recommend you use a logon script instead. Let the font install itself.

Answer 2

Hi,

Thank you for posting your query.

Kindly follow the steps provided below to resolve your issue.

There are several ways to install fonts:

1. registry windows
2. PowerShell
3. wrap font in msi

A little self promotion:

Article on how to wrap msi font for gpo https://www.silentinstall.org/font-to-gpo

Go to this link for your reference and other troubleshooting procedures https://techcommunity.microsoft.com/t5/windows-server-for-it-pro/deploy-fonts-via-gpo/td-p/874103

Note: This is a non-Microsoft website kindly take precautions before downloading anything.

Do not hesitate to message us if you need further assistance.

If the answer is helpful kindly click "Accept as Answer" and up vote it.