Share via

Registry.pol file

Vijayanand Arunagiri 1 Reputation point
2022-08-05T18:32:07.357+00:00

I have created a DSC profile which in turn creates registry.pol file under GroupPolicy directory. Then this gets executed using lgpo.exe. When I tried to apply this settings to a domain joined computer, I wanted to understand if one or more registry settings defined in the AD GPO under GPP corresponding to regsitry.pol has different values other than configured in regsitry.pol file,

  1. Are the values from AD GPO GPP's will update directly on the registry or it creates/amends "registry.pol" file and the group policy client on the target machine implements this?
Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,997 questions
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gary Reynolds 9,406 Reputation points
    2022-08-06T23:20:07.387+00:00

    Hi @Vijayanand Arunagiri

    Group Policies supports multiple client side extensions (GPE), each one supports different functionality, and they store their configuration data in different locations either in the Group Policy Container (AD) or the Group Policy Template (Sysvol) - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpod/351cf7ff-d4d8-4e80-b5dc-6a51a328c6c4

    The register.pol is the legacy location for GPO settings, with the introduction of GPP the configuration for these settings moved to xml files in the Preferences folder in sysvol.

    I don't believe there is any GPP configuration data is stored in registry.pol. You can use GPO Explorer in NetTools to view the settings that existing in the registry.pol and GPP xml files. https://nettools.net/gpo-explorer/

    228766-image.png

    0 comments
  2. Vijayanand Arunagiri 1 Reputation point
    2022-08-07T17:37:50.407+00:00

    Thanks @Gary Reynolds
    Actually, I mistakenly provided the details in a different context. Let me rephrase.
    I created a DSC profile which created Registry.pol file under C:\Windows\System32\GroupPolicy\Machine folder . This gets executed by group policy client and it executes successfully. (that means, it creates all Regsitry settings in the resgistry hive).

    I tested this in a stand alone VM.
    Next thing, I Tested the same DSC in a domain joined machine. Now the question is, if one of the domain AD GPO has any setting defined under Administrative template that will be stored in Registry.Pol file under "sysvol" in a domain controller, would that Registry.Pol file from DC SySvol folder gets downloaded to each target machine and overwrite the registry.Pol file (if it has different setting for a control) created by local DSC engine? So let's say, if I create DSC profile that affects 50 Registry settings and is stored locally under C:\Windows\System32\GroupPolicy\Machine path, and if the AD GPO has a registry.pol file that has different values for those 50 controls,

    1. Will Registry.Pol file from AD SYSVOL folder gets downloaded overwrites the contents in the local Registry.Pol file under C:\Windows\System32\GroupPolicy\Machine?
    2. If local Registry.Pol file created by DSC consists of 50 registry controls and if the AD GPO's SYSVOL Registry.Pol file consists of 100 controls (Additionally 50 registry settings), would be the Registry.Pol file from SYSVOL overwrites the local one when the Group Policy gets refreshed?
    0 comments
  3. Gary Reynolds 9,406 Reputation points
    2022-08-08T09:05:08.427+00:00

    Hi @Vijayanand Arunagiri

    1) The files that constitute the registry are stored in two location, the HKCU is stored in the user's profile directory, and the HKLM, Root and Config, are stored in the C:\Windows\Systems32\Config folder. The registry.pol in the C:\Windows\System32\GroupPolicy\Machine is an artefact of the GPO Engine, the policies are downloaded but they are saved in the C:\Windows\System32\GroupPolicy\DataStore folder. If you download v1.31.3 beta or later of NetTools, it has a new option in the GPO Explorer to display the contents of registry.pol files. You can use this option to view the contents of these files.

    2) The default behavior of GPO Engine, is that settings are overwritten by policies based on precedence of the policies. with DSC, it will depend when these settings are applied during the boot process, if they are one off settings, then the GPO will overwrite them if they contain the same settings.

    With GPO processing, the registry.pol doesn't overwrite the existing registry files, they are merged, so only the settings that are in the GPO are added to the registry. By default most GPO settings are applied to the HKLM\HKCU\Software\Polices, which is specific for GPO settings, this location is volatile and will be deleted before the GPO registry settings are applied. Settings which are out of this location are not removed, and overwrite the existing settings, these are referred to as tattoo settings. The GPO settings should be removed once the policy goes out of scope.

    Gary.

  4. Vijayanand Arunagiri 1 Reputation point
    2022-09-11T09:22:53.747+00:00

    In a nutshell, my whole question is related to how long a registry.pol file will get generated completely if I either delete it under the C:\windows\system32\GroupPolicy\Machine directory or rename it and run GPUPDATE /FORCE.

    239815-image.png

    For example, in the attached image, I renamed Registry.POL file to "old" and ran GPUPDATE/FORCE but It did not create a fresh registry.pol file. After 8 hours, I login to the same VM and Ran GPUPDATE/Force again and this time, it created a registry.pol with 3 KB in size. The original Registry.pol file which is renamed is 126 KB in size. So obvioulsy, the newly auto created registry.pol file did not contain all of the registry settings. And I believe, even this newly created "registry.pol" file has the configurations of 3 KB in size came from SCCM Agent which also updates the Registry.POL file. So My question is that, would be there any registry.pol file with the contents directly updated from any domain controller? (and if so,

    1. what would be the time period that any registry.pol gets created with all of the settings/configurations coming from Active Directory/Domain controller
    2. How long will it really takes for a Group Policy client in a VM to create the registry.pol file in case if its not present there?
    0 comments
  5. Gary Reynolds 9,406 Reputation points
    2022-09-12T11:09:22.077+00:00

    Hi @Vijayanand Arunagiri

    I'm struggling to find a definitive answers to your questions, I've found a number of articles that say that the registry.pol file will be created if it's deleted but haven't found the details in the specification doc on how and when. We can expect the GroupPolicy\Machine\registry.pol file to contain the settings associated to the machine based policies. One of the reasons why that the file is not being created when you run the /force update, could be that these settings are only applied when the machine is rebooted, or at at the policy refresh interval.

    what would be the time period that any registry.pol gets created with all of the settings/configurations coming from Active Directory/Domain controller

    Typically the machine based policies are applied when the machine is rebooted

    How long will it really takes for a Group Policy client in a VM to create the registry.pol file in case if its not present there?

    If the file is not created with /force, then I would expect it to get created at the next policy refresh policy interval, which is typical 90 minutes + random 0-30 minutes.

    One option to confirm what settings are in the files and which policy the settings are from, you can use NetTools to do this - https://nettools.net/how-to-read-the-contents-of-registry-pol-files/

    Gary.