What you're referring to is known as "tattooing" the registry, and is a
painful artifact of prior policy functionality. But you already know that.
:-) My question to you is, can you enumerate the settings to which you're
referring, or are we talking about zillions of settings? If you can specify
which things you want to get to a known state, it may be doable- we'd just
need more information.

Laura

> -----Original Message-----
> From: matthew patton [mailto:pattonme (at) yahoo (dot) com [email concealed]]
> Sent: Thursday, October 20, 2005 4:57 PM
> To: focus-ms (at) securityfocus (dot) com [email concealed]
> Subject: security policy 'not specified' option
>
> Some time back I used a security policy editor that had 3 options:
> enabled, disabled, and 'unset'. By not setting it either way,
> the machine inherited the domain settings. Unfortunately the
> standard system policy editors shipped with 2K/2K3/XP don't
> appear to have that 3rd option which means now I've got all
> kinds of machine running with who knows what setting and
> ignoring the domain policy. And once you've selected
> en/disabled via the radio box, there isn't a way to unset it.
> How do I dig myself out of this?
>
> I probably can play Registry Magic and accomplish what I need
> but I could have sworn I had a tool that would let me do what
> I used to be able to do.
>
> any ideas?
>
> --------------------------------------------------------------
> -------------
> --------------------------------------------------------------
> -------------
>

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

[ reply ]