enable registry editor in winxp

Running winxp pro in a w2k server domain currently the registry editor has been disabled on these winxp pro machines eventhough logged in as a domain adminstrator keep getting this error message " The administrator has disabled registry editor"
The strange thing is even logged in as a local admin i still get this message & regisrty editing is still disabled.
Any advise on how i can regain registry editing on these winxp machines. I've upgraded all the machines to winxp pro so i nolonger have any w2k workstation.
Thanks in advance :)

tried safe mode?

Tried checking the local policies? If you cannot open local policies then it may be an indicator of a trojan.


there is a vbs script here that may help

Quote:

---

Originally Posted by NooNoo

tried safe mode?

Tried checking the local policies? If you cannot open local policies then it may be an indicator of a trojan.


there is a vbs script here that may help

---

Hi! i can go into local policy but not regedit also i cannot go into the link you gave me i need to signup inorder to access the page

Quote:

---

Originally Posted by NooNoo

tried safe mode?

Tried checking the local policies? If you cannot open local policies then it may be an indicator of a trojan.

---

So my turn to be the voice of caution ! (as I got so much 'pooh' last time I ventured an answer to a 'security' issue !!) .. Or it may be an indicator that this particular user doesn't have sufficient access privilege for a reason !!!

Quote:

---

.. cannot go into the link you gave me i need to signup inorder to access the page..

---

No signups required ;) - if you really do have domain admin access, everythings there except maybe this bit ..

Quote:

---

..REGEDIT.EXE is based on the Windows95 version and has features that REGEDT32.EXE lacks (such as search). In general REGEDIT.EXE is nicer to work with. REGEDIT.EXE also shows your current position in the registry at the bottom of the window.

REGEDT32.EXE allows full ACL modification on all registry values which REGEDIT.EXE does not.

---

ACL (Access Control List) here means that domain wide restrictions are only 'doable' with regedt32.

In local group policy (start/run type cmd, enter, at the command prompt type gpedit.msc, do it this way to prevent showing this command in the start/run most recently used list).

Then under <Local Computer Policy\Administrative template\System> then under the other pane you will see "Prevent access to registry editing tools".

Under the Explain tab it says this:

Quote:

---

Disables the Windows registry editors, Regedit.exe and Regedit.exe.

If this setting is enabled and the user tries to start a registry editor, a message appears explaining that a setting prevents the action.

To prevent users from using other administrative tools, use the "Run only allowed Windows applications" setting.

---

Quote:

---

Originally Posted by Ya_know

In local group policy (start/run type cmd, enter, at the command prompt type gpedit.msc, do it this way to prevent showing this command in the start/run most recently used list).

Then under <Local Computer Policy\Administrative template\System> then under the other pane you will see "Prevent access to registry editing tools".

Under the Explain tab it says this:

---

i've tried that under the " disable registry editing tools" it is not configured do i need to disable this option so i can gain access to registry for my user terminal?

Well if it shows as not configured then something else is causing your problem. Did you try disabling it to see if that resolves your issue? You never know...

Is there a domain issued policy being distributed to this PC/user that could be over riding the local policy?


Did you try regdt32.exe as was suggested by confus-ed? Because if both tools are disabled, then you have a sure bet that Group policy is to blame, if it's just one, then it may be something fishy.

You say all the new XP machines do this, who configured them, or where did you buy them from? Is it something that someone else implemented that you could follow up with to get the straight scoop?

Quote:

---

Originally Posted by Ya_know

Well if it shows as not configured then something else is causing your problem. Did you try disabling it to see if that resolves your issue? You never know...

Is there a domain issued policy being distributed to this PC/user that could be over riding the local policy?


Did you try regdt32.exe as was suggested by confus-ed? Because if both tools are disabled, then you have a sure bet that Group policy is to blame, if it's just one, then it may be something fishy.

You say all the new XP machines do this, who configured them, or where did you buy them from? Is it something that someone else implemented that you could follow up with to get the straight scoop?

---

the regedt32.exe does not work as well; you've any idea where i should configure it in the domain policy to enable the regedit feature i'm trying to configure the domain policy such that the users cannot use the registry editing tools but i've yet to configure it & it already does not work

That's the thing, registry editing is enabled by default, so something is in place that turned it off. Have you tried logging into the PC as the local administrator? And this same thing takes place?

I have seen in trusted multi-domain environments where a domain admin is defaulted in the local admin group, but the domain admin of another domain isn't, thus local administration tasks are not permitted, even as a domain admin (of the alternate domain) Are you in any environment that might cause this sort of thing to happen?

As far as suggesting the GPO function to use, isn’t it in the same place under the administrative template under the User Configuration? You also need to reconcile all policies, and ensure that one isn’t overriding another. Does anyone else have access to your GPO’s, or you’re active directory, that could be implementing this without your awareness?

Quote:

---

Originally Posted by kababoom

the regedt32.exe does not work as well; you've any idea where i should configure it in the domain policy to enable the regedit feature i'm trying to configure the domain policy such that the users cannot use the registry editing tools but i've yet to configure it & it already does not work

---

After you change it, are you saving the policy back out to a net logon directory ?

Quote:

---

Originally Posted by edball

After you change it, are you saving the policy back out to a net logon directory ?

---

tried safe mode local admin also do not work i'm also in the domain admin group as well is there any place in the group policy that i might have disabled it i've excluded admin & domain admin not to be affected by the group policy i've set but still this error occurs

Quote:

---

Originally Posted by kababoom

tried safe mode local admin also do not work i'm also in the domain admin group as well is there any place in the group policy that i might have disabled it i've excluded admin & domain admin not to be affected by the group policy i've set but still this error occurs

---

The domain group policy will overrule the local policy if you log into the domain. It shouldn't do that if you log in locally.

Ok, so you do have a group policy in place here, and your actual problem is not the policy, but why the admins (which you specifically excluded) are being effected by this policy...Now you got me. I don't know what you've done...and I am scared to try to figure it out. I might lose a few brain cells. Maybe you could elaborate on exactly what you have done, then tell us exactly what you desire the result to be, then what exactly is happening (which you've covered some of this, but not all). Try to eliminate the confusion…

Quote:

---

Originally Posted by Ya_know

Ok, so you do have a group policy in place here, and your actual problem is not the policy, but why the admins (which you specifically excluded) are being effected by this policy...Now you got me. I don't know what you've done...and I am scared to try to figure it out. I might lose a few brain cells. Maybe you could elaborate on exactly what you have done, then tell us exactly what you desire the result to be, then what exactly is happening (which you've covered some of this, but not all). Try to eliminate the confusion…

---

Initial created a group policy to disable registry editing for my users by this policy does not include admins. The strange thing is my admin is affected by this particular registry editing policy but not the rest of the policy i've created for the users such as the"run" does not show in the start menu etc.
I've reseted the policy back to factory default but still i cannot access the regisrty editing for the users or admin group.
any ideas?

Have you any PC's that can run regedit? If so, can you open a remote PC from one that works to one that doesn't?

I am curious what sort of access you might find there, with remote registry editing you don't get all of the root keys, but you get Local Machine...which may or may not house something that we can adjust, but this is a long shot.

First thing is to determine remote access.

Quote:

---

Originally Posted by Ya_know

Have you any PC's that can run regedit? If so, can you open a remote PC from one that works to one that doesn't?

I am curious what sort of access you might find there, with remote registry editing you don't get all of the root keys, but you get Local Machine...which may or may not house something that we can adjust, but this is a long shot.

First thing is to determine remote access.

---

none of my pc an run regedit only the w2k server is able to