Group Policy script to add/update HKCU registry key during shutdown

Question

There are a few ways to add or update a key in the HKCU registry. There are a few ways to modify a workstation with Group Policies. I have tried a few of these, and I could use some help.

I have a set of four cscripts that I compile to exe with VBSEditor from Adersoft.

These compiled scripts run very well and are faster than running a .vbs script.

I have a script for Startup, Logon, Logoff, and Shutdown. Currently these scripts access the SQL server and server file shares (logon and logoff only), read the local registry and run some commands via the wscript.shell object. All of this works as expected, within the limits that tasks that require admin privileges must run during shutdown/startup and tasks that require network access (fileshares and sql server) must run during logon and logoff.

My problem occurs when trying to create and/or modify a registry key in HKCU. I can read the keys just fine, and my scripts work when run from an administrator login session, but they do nothing when run during GPO startup, shutdown, logon or logoff.

Due to my lack of experience, I do not know most of the quirks of the environment that Group Policy scripts must run in.

Here is one set of commands that works in the console but fails in GPO:

set oRegistry = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
strValueName = "NoControlPanel"
oRegistry.CreateKey HKEY_CURRENT_USER, strKeyPath
oRegistry.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName,drtval

And here is an alternative method:

strKeyPath = "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
strValueName = "NoControlPanel"
strKP = strKeyPath + "\" + strValueName
o=wshShell.RegWrite(strKP, drtval, "REG_DWORD")

drtval is 0 or 1 depending on whether I enable or disable the registry tools.

Can someone see what I am doing wrong?

The particular workstation I am testing this on is an XP Pro. I have about 100 of these puppies to manage via GPO.

Any help would be appreciated.

Answer 1

After much testing and trial and error, I have learned the following:

Sometimes, it is the case that a registry key that is normally created in HKCU can also be created in HKLM.

All examples that I found with google point to modifying the HKCU key for this key.

This works in the current session, in regedit or via scripts, and following a reboot, the change is effected.

But using this script in the Group Policy Shutdown script, it fails.

Grasping at straws, I changed the hive in the scripted GPO command to HKLM and voila.. It works.

I don't know exactly why, perhaps a "super user" could explain it for us, but I have never found this documented this way, and I hope it helps someone else avoid a few days of hair pulling.

Corrected for use in Group Policy Shutdown script:

set oRegistry = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
strValueName = "NoControlPanel"
oRegistry.CreateKey HKEY_LOCAL_MACHINE, strKeyPath
oRegistry.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,drtval