Help Writing a Batch Script to allow Group Policy Editor access

StereoMadnessss · 19 Mar 2023

Recently I have been making scripts to unlock administration locked machines (group policy, security policy, registry settings), and performing this without registry or group policy access seems impossible. If there is any way that I can make it modify the registry without registry or group policy access, that would make this script able to unlock practically any machine in any situation.
If there is a way to perform this, it would be key to expanding this script.
-StereoMadnessss

Try3 · 19 Mar 2023

"administration locked machines" - I do not know what you intended to mean by using this undefined term.
"modify the registry without registry ... access" - This seems contradictory.

Different Registry Keys & Sub-Keys have different Permissions [just like different folders do] and those Permissions can be altered just like folder Permissions can be.
The only possible way of guaranteeing write access to every Key & Sub-Key would be to run as the TrustedInstaller.
There are third-party utilities that can help you do so. I've used MS SysInternals PSExec to impersonate the System; I cannot remember if I could have used it to impersonate TrustedInstaller.

But what's the point? What are you trying to achieve?

Denis

dalchina · 19 Mar 2023

And in what context- e.g. to make changes on a work PC locked by your IT dept?

StereoMadnessss · 19 Mar 2023

The main premise is to create a program that reverses any changes relating to administration as a utility program in case I mess up some administration settings on some computers

Try3 · 20 Mar 2023

I'm still not at all clear about which bits of the Registry you want to be able to restore.

I rely on system images to get me back to earlier states.
I do backup each Registry Hive every month but that is in order to have references to read whilst investigating problems. NotePad cannot cope with the size of some Registry Hives so I use NotePad++ to read them.

If you do end up exporting selected Registry Keys in preparation for restoring them then do export them as .reg files.
- The .txt export option does not create files that can be restored [and they are harder to read in Notepad than exported .reg files].
- It is likely to be during restoration of .reg files [restoration of Registry Keys] that you'd have most need of impersonating TrustedInstaller but there might well be some Keys that you'd need TrustedInstaller privileges to read-export in the first place.

Thanks for the rep,
Denis