1

I am trying to block driver update for a microphone as described here.

But I have windows 10 Home edition. So I didn't have gpedit.msc by default. I installed it. Run it and I see I don't have Device Installation inside menu Local Computer Policy → Computer Configuration → Administrative Templates → System.

I do have Device Installation on another windows 10 Enterprise machine. So I decided to export these settings from enterprise to home windows edition. I am using LGPO.exe for it.

I exported Local Group Policy Settings from windows enterprise successfully using:

LGPO.exe /b backup_path

But import failes on windows home. I run

LGPO.exe /g backup_path

and have:

C:\WINDOWS\system32>LGPO.exe /g C:\Users\Евгений\Downloads\backup\backup
LGPO.exe v2.2 - Local Group Policy Object utility

Audit policy directory exists
Copied C:\Users\
[[[ Security template log file output follows:  C:\Users\B7E3~1\AppData\Local\Temp\GPTEE39.tmp ]]]
Completed 1 percent (0/63)      Process Privilege Rights area
Completed 3 percent (1/63)      Process Privilege Rights area
Completed 4 percent (2/63)      Process Privilege Rights area
Completed 6 percent (3/63)      Process Privilege Rights area
Completed 7 percent (4/63)      Process Privilege Rights area
Completed 9 percent (5/63)      Process Privilege Rights area
Completed 11 percent (6/63)     Process Privilege Rights area
Completed 12 percent (7/63)     Process Privilege Rights area
Completed 14 percent (8/63)     Process Privilege Rights area
Completed 15 percent (9/63)     Process Privilege Rights area
Completed 17 percent (10/63)    Process Privilege Rights area
Completed 19 percent (11/63)    Process Privilege Rights area
Completed 20 percent (12/63)    Process Privilege Rights area
Completed 22 percent (13/63)    Process Privilege Rights area
Completed 23 percent (14/63)    Process Privilege Rights area
Completed 25 percent (15/63)    Process Privilege Rights area
Completed 25 percent (15/63)    Process Group Membership area
Completed 49 percent (30/63)    Process Group Membership area
Completed 49 percent (30/63)    Process Registry Keys area
Completed 49 percent (30/63)    Process File Security area
Completed 49 percent (30/63)    Process Services area
Completed 65 percent (40/63)    Process Services area
Completed 73 percent (45/63)    Process Services area
Completed 73 percent (45/63)    Process Security Policy area
Completed 77 percent (48/63)    Process Security Policy area
Completed 84 percent (52/63)    Process Security Policy area
Completed 88 percent (55/63)    Process Security Policy area
Completed 93 percent (58/63)    Process Security Policy area
Completed 100 percent (63/63)   Process Security Policy area


No mapping between account names and security IDs was done.

The task has completed with an error.

SECEDIT.EXE exited with exit code 1
----------------------------------------------------------------------

How to fix that No mapping between account names and security IDs was done. error or maybe I should export/import Local Group Policy Settings in another way?

Maxim Yefremov
  • 1,295
  • 5
  • 16
  • 22

3 Answers3

3

For Windows 10 Home users who do not have gpedit.msc, you might try to do this manipulation on another computer, not Home, then export and import the policy to the Home computer from the registry key. You will need to find where in the registry is stored the particular policy.

Or you may try to use the program Policy Plus, which is a Local Group Policy Editor for all Windows editions. See this article for more information.

image

harrymc
  • 498,455
0

This does not solve the problem entirely. For Home Edition, you will need ADMX files whether you import with lgpo or Policy Plus, policy plus just simplifies this process, but they are somewhat out of date (2017) at the time of this post. Still nothing out there that is tangible, no info online anywhere that i could find. LGPO.exe will not throw any error if you edit {********-****-****-****-************}\DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf and remove the "[Privilege Rights]" section completely.

This means "User Rights Assignments" is the only section not importing or rather, not being properly mapped after import. Deleting the section removes the errors.

In Home edition you wont have any ADMX files to actually see them under gpedit.msc; this is where Policy Plus shines... however the developer claims it works with "Administrative templates" only, and is a long way from supporting importing / exporting Local Windows/Security policy (user rights and security options).

If anybody has any solution to this error code, and can tell us whether or not it really matters, if it is a security threat, if lgpo.exe skips the import, or if it does, will windows re-map the ID's itself upon import/reboot or something, I would be very grateful to hear it.

Boja
  • 23
  • 4
0

That is correct Boja. Although, in my case I was trying to import the settings from a copy of a domain policy into a standalone Win7 client, and was getting the same error. But I did not remove the whole [User Rights Assignments] section, just the reference to Domain Admins, Enterprise Admins, *S-1-5-32-546 (Guests), and any proprietary domain admin groups in that section, specifically from the following policies:

SeDenyBatchLogonRight = SeDenyServiceLogonRight = SeDenyInteractiveLogonRight = SeDenyNetworkLogonRight = SeDenyRemoteInteractiveLogonRight =

Once I did that, LGPO imported the GPOs without a glitch!

LGPO.exe /g backup_path

Hopefully this will help someone else.

Cheers!

ceez38
  • 1