无法使用 Powershell 将组策略（本地 gpo）状态更新为“未配置”

Question

With PowerShell, by updating corresponding registry keys we can able to toggle the local GPO status to "Enabled" or "Disabled", but I have a specific requirement to make sure that certain local GPOs are set to "Not configured". Tried deleting corresponding registry keys but it didn't help.

Is there any way to achieve this in PowerShell?

Answer 1

If I run Local Group Policy Editor ( gpedit.msc ) as Administrator and set the Computer Configuration\\Administrative Templates\\System\\Removable Storage Access\\Removable Disks: Deny write access policy to Enabled or Disabled , according toProcess Monitor that is actually setting the Deny_Write value at HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\{GUIDGUID-GUID-GUID-GUID-GUIDGUIDGUID}Machine\\Software\\Policies\\Microsoft\\Windows\\RemovableStorageDevices\\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} .

If I modify, delete, or rename that Deny_Write value as Administrator then I see the change reflected in Local Group Policy Editor when I edit/reopen that policy. I'm not exactly certain how it is that a machine policy is being set under a user's registry; perhaps there's a symbolic link or loaded hive at play. Process Monitor indicates that C:\\Windows\\System32\\GroupPolicy\\Machine\\Registry.pol is also modified at the time I set the policy, so that must be the underlying storage for Group Policy -based registry changes.