How to edit local group policy objects via command line?

Question

Is there a way to change or edit certain group policies via command line?

We are currently installing a lot of PCs based on an image. After the install is done, certain group policies need to be changed, which we have to do manually at this point.

I Would like to add these changes in a script so I can create a script per department to enforce these group policies.

For example: Set "Computer Configuration / Management Templates / Configuration Panel / Online Tooltips" to "disabled" via a script.

Thanks!

Answer 1

Since the Group Policy settings are stored in the Registry, the easiest method to create department-wide configurations might be through a .reg file,

Microsoft maintains a list of the Group Policy Registry keys. For example, line 188 shows HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!AllowOnlineTips controls online tooltips.

Rather than synthesizing the .reg script from scratch, you could "reverse engineer" such a script by taking a snapshot of the Registry of a freshly created clone, applying appropriate changes through the Group Policy Editor, and then diffing that snapshot with a new one. An excellent tool for this purpose is Nirsoft's RegistryChangesView, which can "export the Registry changes into a standard .reg file".

Of course, if you're running a batch script anyway, just add a line to it:

regedit.exe /s "full path to your .reg file"

You can also use a PowerShell script to convert Registry files to XML, which can then be pasted directly into Microsoft's Group Policy Editor.
For example,

• Import .reg files into Microsoft Group Policy
• Convert REG to XML to import Registry key into Group Policy Preferences
• GitHubGist/Appa-lw/Reg2GPO.ps1

Answer 2

I would not recommend to rely on registry changes when I want to achieve a policy. A policy isn't always a registry entry and vice versa... Especially when it comes to the processing order there are differences as well as the stage of implementation (image, pre- / post-sysprep) depending on the hive (if the policy sets a registry value).

From personal experience I would prefer to set and apply a GPO rather than editing reg values manually. We hat the issue that reg settings were not finding there way back to the policy and policy settings were overriding the reg value.

Some nice way are PS cmdlets very well explained here: https://www.powershellmagazine.com/2012/05/14/managing-group-policy-with-powershell/

Answer 3

Some policies are stored in C:\Windows\System32\GroupPolicy in CSV format.

Audit policies can be set via auditpol command.