How to Deploy LOCAL Group Policy changes via DOMAIN Group Policy

the ultimate task:  create windows 7 kiosk

scenario:

1. mobile computers on domain.
2. domain accounts blocked logging in domain gpo
3. windows 7 pro setup auto-logon using local user account

windows registry editor version 5.00

[hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon]

"autoadminlogon"="1"
"defaultpassword"="xxx"
"defaultusername"="xxx"

4. creating domain gpo (all user side entries) applies settings domain user accounts only.
5. applying same settings local group policy has desired effect of applying local user accounts.

local computer policy
.> computer configuration
..> administrative templates
...> system
....> logon
      = hide entry points fast user switching
        + enabled

local computer policy
.> user configuration
..> administrative templates
...> start menu , taskbar
     = remove logoff on start menu
       + enabled

local computer policy
.> user configuration
..> administrative templates
...> system
....> ctrl+alt+del options
     = remove change password
       + enabled
     = remove lock computer
       + enabled
     = remove task manager
       + enabled
     = remove logoff
       + enabled

there way push out these local policy settings via domain policy apply local accounts?  i know these settings exist hkcu, see fed local user accounts hku.  they exist in hku guid specific paths.

dump files make local policy settings computer, i'd rather inject these particular local policy settings merge there.

ideas or nonos?

hi robert,

local group policy , domain group policy has  different storage , implementation mechanism. local group policy object stored in %systemroot%\system32\grouppolicy. when local group policy applies, registry settings registry.pol under machine of user folder of directory. if there no settings found here, local group policy not applied. won't local registry settings when processing domain group policy.

these articles may helpful:

local group policy objects
http://technet.microsoft.com/en-us/library/cc978247.aspx
non-local, active directory-based storage
http://technet.microsoft.com/en-us/library/cc978276
group policy processing , precedence
http://technet.microsoft.com/en-us/library/cc785665(ws.10).aspx

 

as your ultimate goal create kiosk windows 7 machines, please refer the following articles how achieve it:
how can setup local computer use internet kiosk computer?
http://support.microsoft.com/kb/555463
using gpo make kiosk machine
http://social.technet.microsoft.com/forums/en-us/winservergp/thread/de536fae-313a-4cb9-ae41-9715412ce99f/

regards,
cicely

Windows Server  >  Group Policy