Registry keys created by GPO still exist after GPO disabled

Question

Hi everybody,
I have issue with a GPO that changes the desktop background of certain users of one computer. I automated the creation of the GPO with powershell, so my script looks like this :

$gpo_exist=Get-GPO -Name "ChangeWallpaperInBlue" -erroraction ignore
if ($gpo_exist) {
Remove-GPO -Name "ChangeWallpaperInBlue"
}
else {
}

New-GPO -Name "ChangeWallpaperInBlue" -comment "Change the wallpaper to a solid blue color"
New-GPLink -Name "ChangeWallpaperInBlue" -Target "OU=myOU,DC=domain,DC=local"
New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies" -Name "System"

###Set-GPRegistryValue -Name "ChangeWallpaperInBlue" -Key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" -ValueName Wallpaper -Type String -Value "C:\Users\Public\img.jpg"
Set-GPPrefRegistryValue -Name "ChangeWallpaperInBlue" -Context User -Action Replace -Key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" -ValueName Wallpaper -Type String -Value "C:\Users\Public\img.jpg"

###Set-GPRegistryValue -Name "ChangeWallpaperInBlue" -Key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" -ValueName WallpaperStyle -Type String -Value "3"
Set-GPPrefRegistryValue -Name "ChangeWallpaperInBlue" -Context User -Action Replace -Key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" -ValueName WallpaperStyle -Type String -Value "4"

The thing is when I delete the link between the concerned OU, the registry keys that the GPO create are still there even after gpupdate /force, rebooting, logging off/on, etc. I have to delete the keys manually.

I tried with both Set-GPRegistryValue and Set-GPPrefRegistryValue (I don't get the difference by the way).

How can I manage to make a GPO that create registry key and delete them when it is disabled?

And to make my script powershell better, how could I manage to make the GPO create the "System" key by itself and remove it after the GPO is disabled?

PS: I use the same computer to execute this script and log as the different users so I can use New-Item because it's the same registry. I think you understood the problem that when I will add new computers it won't work because the "System" won't be created on the other computers...

Answer 1

Hello @Thomas R ,

Thank you for posting here.

One difference between Policies vs Preferences is as below:

A policy is removed when the GPO goes out of scope—that is, when the user or computer is no longer targeted by the GPO. A preference, however, remains configured for the targeted user or computer even when the GPO goes out of scope. Another way of saying this is that preferences tattoo the registry on the client computer, while policies do not tattoo the registry on the client computer.

As I can see, you set registry via setting Set-GPPrefRegistryValue (Preferences setting). So when you disable GPO, the registry settings are kept.

For more information about differences between Policies vs Preferences, please refer to link below.

Policies vs Preferences
https://techgenix.com/policies-vs-preferences/

I am sorry, I am not the expert about PS script. However, here are my suggests about your question.

Suggest 1

Delete the GPO under the specific OU (the GPO will still in Group Policy Objects, it is only not linked to the specific OU), and create a new GPO with deleting the registry you set.

navigate to User Configuration\Preferences\Windows Setting\Registry and edit the GPO as below. Then link the GPO to OU with domain users you want.

Then update GPO to see if it helps.

Suggest 2

Modify the PS script above to remove/delete the Registry Value you want and update the GPO to see if it helps.

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.