Distributing Registry Changes

A template's syntax uses keywords that are linked to variables; the variables reference registry keys. A template with one option would use the following syntax:

CLASS
   CATEGORY
        KEYNAME
		POLICY
		PART
		    VALUENAME "value"
			VALUEON
			VALUEOFF
		END PART
		END POLICY
	END CATEGORY
[Strings]

CLASS names the registry section (i.e., MACHINE for HKEY_LOCAL_MACHINE or USER for HKEY_CURRENT_USER). Every template has either one or two CLASS indicators. You must group all the policies for one CLASS before you take on the second CLASS (if you're using two classes). Template files don't include an END CLASS line; instead, the naming of a new CLASS specifies the end of the previous CLASS. The beginning of the [Strings] section marks the end of the second CLASS.

CATEGORY defines the beginning of a category (and becomes a book icon in the SPE window's display); END CATEGORY defines the category's end. A category is a group of policies with a logical connection, all of which appear as a heading that you can expand in the SPE window. You can nest categories. The CATEGORY command uses a variable that represents a text string, delineated in the [Strings] section of the template. The text string appears in the SPE window as the definition of the policy.

KEYNAME is the registry key that holds the entry for the policy. If the key doesn't already exist, KEYNAME will be a new registry key that will hold the entry. If the registry path to the key contains spaces, enclose the entire key path (excluding HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER) in quotation marks.

POLICY is the policy setting. The setting must exist within a CATEGORY, and its name describes its function. A POLICY is accompanied by a three-state check box that appears in the SPE window so that you can specify whether to enable, disable, or ignore the policy. END POLICY specifies the end of the policy.

PART signals the beginning of a part within a policy (policies can have multiple parts). END PART signals the end of a part. PART is used for more complicated policies that need to establish additional values in the Settings box at the bottom of the SPE window. By additional values, I mean that the policy requires more options than enable or disable. If you're setting a wallpaper policy or a screen saver policy, you need to enter the name of the appropriate file. You can also use PART to display explanatory text in the Settings box.

VALUENAME is the name of the registry entry (i.e., subkey or data item) that you're modifying or creating. If the VALUENAME entry in the registry has any spaces, enclose the name in quotation marks.

VALUE is the value you want to assign to the registry entry defined by VALUE NAME. VALUE can be text (which you must enclose in quotation marks) or numeric.

VALUEON and VALUEOFF are used for operating SPE in Registry Mode, when the VALUENAME requires nothing more than a check box to enable or disable the policy. Usually, you use the common enable and disable values in the registry: 1 for on or 0 for off.

[Strings] is the final section of the template and lists the variables for the template. Microsoft uses the word "variable," but these are actually the sentences that appear in the SPE window and that describe the policy. Within the template, any entry that's prefaced by two exclamation points specifies a variable that will appear in the [Strings] section. The following lines are part of the [Strings] section in Common.adm. The variable is to the left of the equal sign, and the contents of the variable, enclosed in quotation marks, are to the right of the equal sign.

RemoveRun="Remove Run command from Start menu"
RemoveFolders="Remove folders from Settings on Start menu"
RemoveTaskbar="Remove Taskbar from Settings on Start menu"
RemoveFind="Remove Find command from Start menu"

Your OS automatically distributes system and group policies. (For information about Group Policy distribution, see Randy Franklin Smith, "Controlling Group Policy, Part 2," Winter 2000.)

Healthy Paranoia
The discussions in this article are for administrators who understand the registry well enough to manipulate it without causing destruction or chaos. Although you have a variety of tools for maintaining the registries of your network's computers, approach registry tasks with care. Back up any registry key before you change its contents. Spend a lot of time working with large-scale registry management tasks in a lab environment before you attempt any tasks in the enterprise. And if the registry baffles you—don't mess with it.

End of Article

   Previous  1  2  3  4  5  [6]  Next