在GPO和直接注册表编辑NSIS之间进行选择

Question

I'm writing an NSIS script to upgrade an appliance between versions. The versioning and setup have gotten away from us a bit, as we have many versions in the field, and currently no easy way to upgrade from one version to another. So the first task I have is to write something that they can run on field machines to do everything necessary to bring them to the latest version.

The appliance runs on windows 7. it has 3 users. In the repository for the project there are 4 .msc files that contain group policies to set the appropriate settings for each of these. (computer, non-administrator, admin, appliance)

Is this the right way to go? in trying to power through learning NSIS, it seems easier to write the registry keys directly to HKU /user/... rather than the extra layer of indirection from GPO, given that I'm not doing any sort of distributed system using active directory (which I know approximately nothing about), and just have 3 static users on one static physical machine.

So concise questions:

1. Which approach makes more sense for my application? GPO files, or direct ntuser.dat editing on the various users.

2. if GPO makes sense, how do I apply an msc file inside NSIS? double clicking the file works in windows, but then you have the mmc open. oogly. is there a clean way to do it with NSIS?

3. How does a GPO in the registry under HKCU translate to a system wide policy? it seems to me that what's written to the registry is missing the critical information of which users it applies to (if it applies to a user or group).

Thanks in advance

Answer 1

.msc files usually contain data used by MMC and not policy data, perhaps you mean .adm template files ? I don't think you can really apply a .msc file programmatically.

Direct registry editing is probably OK if your application just reads them normally on the other end, otherwise you might need to call gpupdate .

If your policy is stored under Software\\Policies then entries in HKLM applies to everyone and entries in HKCU/HKU applies to that user. A normal user cannot change their policy under HKCU because they don't have write access. There is not really a concept of groups when using these keys.