Manage Local Group Policy Objects from PowerShell and Desired State Configuration

Ever since DSC was first released, people have been asking how they can use it to manage user-specific settings. For the most part, the answer has been: don’t do that. DSC resources execute as LocalSystem, and are intended to manage system-wide settings.

However, that’s not the whole story. The local Group Policy objects on a computer can be treated as a system-wide setting, and can also be used to enforce user-specific policies. There’s a problem, though: those settings tend to be stored in the Administrative Templates section of the registry, which is saved in a registry.pol file on disk. There are no command-line utilities or APIs in Windows for reading or writing these registry.pol files, and the GroupPolicy PowerShell module cmdlet Set-GPRegistryValue only works for domain GPOs, not local. I’d solved the problem of managing Registry.pol files from a script ages ago, first as a VBScript, and later in C#. The .NET code wasn’t terribly user-friendly compared to a PowerShell cmdlet, but it worked, and I used it extensively in my previous job.

Recently, when this question of managing user-specific settings and/or local GPOs came up again, I decided to write some PowerShell wrappers around that C# class, and DSC resources as well.

The result is the new PolicyFileEditor module, which can be found on GitHub, or via PowerShellGet. The module exposes 4 commands:

Get-PolicyFileEntry [-Path] <string> [-Key] <string> [-ValueName] <string> [<CommonParameters>]
Get-PolicyFileEntry [-Path] <string> -All [<CommonParameters>]

Set-PolicyFileEntry [-Path] <string> [-Key] <string> [-ValueName] <string> [-Data] <Object> [-Type <RegistryValueKind>] [-NoGptIniUpdate] [-WhatIf] [-Confirm] [<CommonParameters>]

Remove-PolicyFileEntry [-Path] <string> [-Key] <string> [-ValueName] <string> [-NoGptIniUpdate] [-WhatIf] [-Confirm] [<CommonParameters>]

Update-GptIniVersion [-Path] <string> [-PolicyType] <string[]> [-WhatIf] [-Confirm] [<CommonParameters>]

There are also two DSC resources (cAdministrativeTemplateSetting and cAccountAdministrativeTemplateSetting) which are wrappers around the *-PolicyFileEntry commands for the various local GPOs.

We immediately put this to good use in one of our dev\test cloud environments were we kept accidentally kicking each other out of RDP sessions:

cAdministrativeTemplateSetting AllowMultipleRdpSessions
{
    Ensure       = 'Present'
    PolicyType   = 'Machine'
    KeyValueName = 'SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fSingleSessionPerUser'
    Type         = 'DWord'
    Data         = '0'
}