Creating a group in active directory?

youcancallmeal

Unfortunately my knowledge of active directory is fairly limited so I was wondering would anyone know know how to create a group in ad that would allow its members have access to the 'HKEY_CURRENT_USER' in the registry?

Martyr

check out Group Policy Management Console

i've not used this, but i know it can be done with this tool and GPO

Stephen

All users should be able to access HKEY_CURRENT_USER anyway, surely?

youcancallmeal

Stephen wrote: »

All users should be able to access HKEY_CURRENT_USER anyway, surely?

Well thats what I thought as well but if they go to run regedit then they just get an access denied error message? I'll probably have to have a go at editing the group policy using the editor that Average Joe linked to, cheers

feylya

How is your default user set up in the domain? Are all users based off a standard model or are they generated from the Microsoft default when they first login?

edit: Hang on, are the users set up as power users or administrators on their own boxes? AFAIK, users can't run regedit at a level lower than Power User

Edit2: Nope, that doesn't matter. The GPO that affects regedit.exe is:
User Configuration-> Administrative Templates->System-> "Prevent Access to registry editing tools"

youcancallmeal

feylya wrote: »

How is your default user set up in the domain? Are all users based off a standard model or are they generated from the Microsoft default when they first login?

edit: Hang on, are the users set up as power users or administrators on their own boxes? AFAIK, users can't run regedit at a level lower than Power User

Edit2: Nope, that doesn't matter. The GPO that affects regedit.exe is:
User Configuration-> Administrative Templates->System-> "Prevent Access to registry editing tools"

Yep that did it, cheers man!

feylya

Go me \o/