Solved

Disabling GPO and Killpol

Posted on 2013-12-20
4
2,804 Views
Last Modified: 2013-12-30
1) How does Killpol disable the applied GPO ? How does it revert the GPO ?
2) How can I create a simple BATCH file to perform similar functions ?
0
Comment
Question by:kaerez
  • 3
4 Comments
 
LVL 76

Expert Comment

by:arnold
ID: 39733067
Check the GPO properties on what happens when it no longer applies.
Once you make sure the GPO settings will revert when it no longer applies.  Let the GPO remain in place for a week or so to make sure the changes if made will have enough time to propagate. Then unlink/remove the policy from applying.  Depending on the settings it control that may not revert.
0
 
LVL 12

Expert Comment

by:Dave
ID: 39740300
I don't know how Killpol disables GPOs and it appears to no longer be available for download so its hard to find out. Policies to be applied end up stored in:-

HKEY_LOCAL_MACHINE\Software\Policies\

and

HKEY_CURRENT_USER\Software\Policies\

generally removing the keys causes the policies to be removed instantly. They automatically re-apply after 15 minutes. So in order to remove "most" policies all you need to do is delete the key in question AND prevent the policy being re-applied.

So check the above keys in the registry and see what KillPol does to them Then replicate this in a batch script.
0
 
LVL 12

Accepted Solution

by:
Dave earned 500 total points
ID: 39740318
Ok found how to stop them re-applying here:-

http://blogs.technet.com/b/markrussinovich/archive/2005/04/30/circumventing-group-policy-settings.aspx

....to stop GP from reapplying.

To change the refresh interval for computers:
Registry key: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\ System
Name: GroupPolicyRefreshTime
Type: REG_DWORD
Valid range for data (in minutes): 0 to 64800

• To change the offset interval for computers:
Registry key: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\ System
Name: GroupPolicyRefreshTimeOffset
Type: REG_DWORD
Valid range for data (in minutes): 0 to 1440



To change the refresh interval for users:
Registry key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\ System
Name: GroupPolicyRefreshTime
Type: REG_DWORD
Valid range for data (in minutes): 0 to 64800

• To change the offset interval for users:
Registry key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\ System
Name: GroupPolicyRefreshTimeOffset
Type: REG_DWORD
Valid range for data (in minutes): 0 to 1440


0 == Never
0
 
LVL 12

Expert Comment

by:Dave
ID: 39740329
Sorry you can use the "reg delete" to delete the values you want to delete.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Recently Microsoft released a brand new function called CONCAT. It's supposed to replace its predecessor CONCATENATE. But how does it work? And what's new? In this article, we take a closer look at all of this - we even included an exercise file for…
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now