GroupPolicyMinTransferRate and Current User

[Toothman]

Hello All,

I have a remote site where I need to apply the key
"GroupPolicyMinTransferRate" to
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System but AS the
users are not admins they do not have the permissions to modify this
key. I've tried using RunAs utilities such as Sanur and psexec but with
no luck. The users who login change frequently and also there might be
new users in the future so I can't just make one user an admin while I
change the key.

Does anyone have an ideas on how I can modify this key?

Cheers,
Corin Casey

[Florian Frommherz]

Howdy Corin!

Post by Toothman
I have a remote site where I need to apply the key
"GroupPolicyMinTransferRate" to
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System but AS the
users are not admins they do not have the permissions to modify this
key. I've tried using RunAs utilities such as Sanur and psexec but with
no luck. The users who login change frequently and also there might be
new users in the future so I can't just make one user an admin while I
change the key.

Since you're posting in a group policy group, I assume that you are able
to apply GPs in your domain and at the remote site. There is a GP
existing for the key you posted - you can find it at:

"UserConf\Adm Templ\System\Group Policy" and there: "Group Policy slow
link detection".

cheers,

Florian

[Toothman]

Sorry Florian,

To elaborate further; I can apply GPs in the local domain but the
remote site is not getting GPs applied unless I manually add the
"GroupPolicyMinTransferRate" key to the the registry. Our routers are
blocking the second icmp request when authenticating with the domain
controller so the machine is aborting GP processing. I also thought of
the PingBufferSize solution but our routers are set to only allow
packets under 108 bytes where the minimum size for PingBufferSize is
500 bytes. I was hoping someone had got around this issue here in
someway where they had the situation of more than one user at the
remote site and needed to add this registry key to various user
profiles.

USERENV(234.608) 11:16:57:450 PingComputer: Adapter speed 10000000 bps
USERENV(234.608) 11:16:57:639 PingComputer: First time: 192
USERENV(234.608) 11:17:02:978 PingComputer: Second send failed with
11010

I guess I could also post in another group just trying to find a way
for a user to modify registry entries in
"HKEY_CURRENT_USER\Software\Policies" as this the real cause of my
problems; it appears that only a user who is logged in and has admin
rights can modify these keys?

Thanks for your time.

[Toothman]

Sorry Florian,

To elaborate further; I can apply GPs in the local domain but the
remote site is not getting GPs applied unless I manually add the
"GroupPolicyMinTransferRate" key to the the registry. Our routers are
blocking the second icmp request when authenticating with the domain
controller so the machine is aborting GP processing. I also thought of
the PingBufferSize solution but our routers are set to only allow
packets under 108 bytes where the minimum size for PingBufferSize is
500 bytes. I was hoping someone had got around this issue here in
someway where they had the situation of more than one user at the
remote site and needed to add this registry key to various user
profiles.

USERENV(234.608) 11:16:57:450 PingComputer: Adapter speed 10000000 bps
USERENV(234.608) 11:16:57:639 PingComputer: First time: 192
USERENV(234.608) 11:17:02:978 PingComputer: Second send failed with
11010

I guess I could also post in another group just trying to find a way
for a user to modify registry entries in
"HKEY_CURRENT_USER\Software\Policies" as this the real cause of my
problems; it appears that only a user who is logged in and has admin
rights can modify these keys?

Thanks for your time.
Corin

[Florian Frommherz]

Howdy Corin!

Post by Toothman
To elaborate further; I can apply GPs in the local domain but the
remote site is not getting GPs applied unless I manually add the
"GroupPolicyMinTransferRate" key to the the registry. Our routers are
blocking the second icmp request when authenticating with the domain
controller so the machine is aborting GP processing. I also thought of
the PingBufferSize solution but our routers are set to only allow
packets under 108 bytes where the minimum size for PingBufferSize is
500 bytes. I was hoping someone had got around this issue here in
someway where they had the situation of more than one user at the
remote site and needed to add this registry key to various user
profiles.

You're sure about that? Even if it is a slow link, regkeys and policies
from UserConf/Adm Templ/... and CompConf/Adm Templ/... will always be
processed, see:
http://support.microsoft.com/kb/227369/en-us
Maybe something else is broken that might prevent the users and machines
from getting the policies. Have you checked the eventlogs?

Post by Toothman
I guess I could also post in another group just trying to find a way
for a user to modify registry entries in
"HKEY_CURRENT_USER\Software\Policies" as this the real cause of my
problems; it appears that only a user who is logged in and has admin
rights can modify these keys?

No. Logon scripts run in the context of the user. If your users aren't
local admins (what's a good policy by the way) they will not be able to
access this regkey to alter it. And so is the logon script.

You could try to write yourself a custom ADM template and change the
regkey - but if the policies won't get applied, chances are that custom
adm templates won't either...

cheers,

Florian

[Toothman]

Thanks for your time Florian.

I'll give it a go but at the moment without the
"GroupPolicyMinTransferRate" key, I get the following error in the
application event log: "Error 1054 - Windows cannot obtain the domain
controller name for your computer network. (An unexpected network error
occurred. ). Group Policy processing aborted.". Also when I try a
gpresult from the CMD prompt; I get the error "INFO: The policy object
does not exist." If I put the "GroupPolicyMinTransferRate" key in
current user and local machine GP applies as normal.

Cheers,
Corin