Federal Desktop Core Configuration : Local Group Policy utilities

Viewing and Comparing IE Security Zone Settings

Aaron Margosis — Thu, 01 Oct 2009 22:27:00 GMT

The Security tab of the Internet Explorer Properties dialog shows security settings for the Internet, Intranet, Trusted Sites and Restricted Sites zones. However:

It doesn’t show settings for the Local Machine (Computer) zone, nor for Local Machine Zone Lockdown (LMZL).
When machine settings or other policies are in effect, most of the Security Zones UI is disabled.

The attached utility “IE Zone Comparer” was designed to overcome these limitations and provide additional visibility into security zone settings. Pick any two collections of security zone settings, and IE Zone Comparer displays the values of those settings, highlighting any differences between the two collections.

IE Zone Comparer requires .NET 2.0 or higher; it does not require administrative privileges.

How to use it:

Click “Pick Zones…” from the toolbar. The following dialog will appear:

The Effective Settings label indicates whether User settings are used or ignored. Refer to this blog post which discusses precedence order of the various policies and preferences.

For each column, there are two dropdowns. The first dropdown lets you select Templates, Machine Policy, Machine Preferences, User Policy, User Preferences, or FDCC Q1 2009 Policies. If you select Templates, the second dropdown lets you select one of the security zone templates (High, Medium-High, Medium, etc.); if you select Policies or Preferences, the second dropdown lets you select any of the five standard zones or five lockdown zones. (See this post for more information about all those zones.)

Click “OK” on the “Pick items…” dialog, and the selected settings will be rendered in the list view. Items that are present in both columns but with different values will be highlighted in yellow. Items that are present only in one column will be grayed in the other column.

Additional Features

To find a particular item with a partial text search, press Ctrl+F (or the “binoculars” toolbar dropdown). The text search is case-insensitive and searches in all columns from the currently-selected row down. Press F3 to repeat the last search from the current location.

Enter a URL in the text area in the toolbar and click “Map URL to Zone”: IE Zone Comparer will tell you in what security zone IE would render that URL.

The Help/About toolbar button includes some helpful links for more information about IE security zones and URL actions.

Some Example scenarios for the IE Zone Comparer

View effective settings for a particular zone. E.g., something isn’t working correctly on a page that is rendered in the Intranet zone. If user settings are being ignored, select Machine Policies / Intranet and Machine Preferences / Intranet. Policies override preferences; where no policy is set, the machine preferences will apply.
Compare the relative security settings of the Intranet zone vs. the Trusted Sites zone (see screenshot above).
Seeing exactly what changes when you transition from the Locked-Down Local Machine Zone to the regular Local Machine Zone. (Description here.)
Compare Machine Policies for a zone to the policies mandated by FDCC Q1 2009.
View the settings that are applied by a given template, and compare those settings to another template or to an existing zone to see whether it has been modified from that template.
Compare the effective settings of the Locked-Down Local Machine Zone (LMZL) to Local Machine Zone, to see what becomes enabled when the user clicks through the information bar.
Compare user preferences for a zone to the machine preferences for the same zone. (They should be the same; if they are not, then results may change when the “use only machine settings” policy is applied.)

[November 7, 2009: An updated version, IEZoneAnalyzer, has been posted that shows the effective settings for a selected zone and where each of the settings are established.]

Source code for New and Updated Local Group Policy utilities

Aaron Margosis — Tue, 15 Sep 2009 20:35:00 GMT

Visual Studio 2008 source and project files for the new ImportRegPol utility and the updated Set_FDCC_LGPO and Apply_LGPO_Delta utilities for managing Local Group Policy Objects.

Note that these are all now Visual Studio 2008 projects.

New and Updated Local Group Policy Utilities

Aaron Margosis — Tue, 15 Sep 2009 20:30:00 GMT

A customer requested an addition to the local group policy toolset posted on the FDCC blog. While working on the new utility, I needed to upgrade the other two. The full set is attached to this post, with documentation. The source code for all of them is attached to a separate post.

The new utility, ImportRegPol, takes a registry policy file (registry.pol) as input. It can import its contents into the local group policy of the local computer (Computer or User configuration), or simply read it and output Notepad-editable text that can be consumed by Apply_LGPO_Delta.

While working on it, I discovered and corrected subtle shortcomings in Set_FDCC_LGPO and Apply_LGPO_Delta. The main shortcoming had to do with when a value or set of registry policy values were to be deleted: if the settings were present when Set_FDCC_LGPO or Apply_LGPO_Delta was run, they would be deleted, but those deletion “commands” were not saved in the policy store. So, if the settings were to be reintroduced, gpupdate from local policy would not remove them. The new implementations insert the deletion “commands” into the policy store so that they can be applied whenever policy refreshes. This required extending the input file syntax for Apply_LGPO_Delta and the log file output for Set_FDCC_LGPO, both of which have been bumped to v2.0.

While I was at it, I upgraded those utilities to Visual Studio 2008 and enabled ASLR and DEP. In addition, the new version of Apply_LGPO_Delta does not perform an OS check, so it is no longer restricted only to Windows XP and Vista, and will run on any supported version of Windows. Set_FDCC_LGPO still runs only on XP (SP2 or higher) or Vista (RTM or higher), because NIST hasn’t defined FDCC settings for any other versions of Windows.

Here is more information on the new ImportRegPol utility:

ImportRegPol

ImportRegPol is a non-interactive tool that imports the settings from a Registry Policy (registry.pol) file into the Computer or User configuration of the local group policy of the current computer. It can also parse a registry.pol file and produce an editable text file that can be consumed by Apply_LGPO_Delta v2.0.

Introduction

Administrators frequently apply policies by copying registry.pol files into the Group Policy folders. This technique is not supported by Microsoft, and has the unfortunate side effect of destroying any previously existing policies. ImportRegPol reads the reference policy file and uses supported application programming interfaces (APIs) to add settings to local policy.

The format of registry policy files is a documented, binary file format, normally produced by Group Policy editors such as GpEdit.msc. However, there aren’t any good viewers or editors for directly manipulating those files. For this reason, the Apply_LGPO_Delta utility uses a custom, Notepad-editable text file format to define specific changes to apply to local group policy. The log file format produced by ImportRegPol is compatible with Apply_LGPO_Delta v2.0. ImportRegPol can be run in a “parse-only” mode to read a registry.pol file and produce an equivalent input for Apply_LGPO_Delta.

The utility requires administrative rights to import policies, but does not require administrator rights for parse-only mode. Note that the in-use registry.pol files in the GroupPolicy folders can be used for input only in parse-only mode.

Command line syntax and usage:

The ImportRegPol command line syntax is described below. All parameters are case-insensitive. The command line must include -m or -u followed by the absolute or relative path to a registry policy file. All other parameters are optional.

ImportRegPol.exe –m|-u path\registry.pol [/parseOnly] [/log LogFile] [/error ErrorLogFile] [/boot]

-m path\registry.pol   [for Computer configuration] or

-u path\registry.pol   [for User configuration]

                        Path\registry.pol specifies the absolute or relative path to the input registry policy file (which does not need to be named “registry.pol”).

/parseOnly             Reads and validates the input file but does not make changes to local group policy. In conjunction with the /log option, can be used to convert a registry policy file to an input file for Apply_LGPO_Delta.

/log LogFile           Writes detailed results to a log file. If this option is not specified, output is not logged nor displayed. The logged results for the registry policy settings can be used as input for Apply_LGPO_Delta.

/error ErrorLogFile   Writes error information to a log file. If this option is not specified, error information is displayed in a message box dialog.

/boot                  Reboots the computer when done.

This utility is not a console app, so you won’t see a console window appear, and if you start it from a CMD prompt, it will run in the background – CMD won’t wait for it to complete. You can check in TaskMgr to see when it completes. If you want CMD to wait for ImportRegPol to complete, run the utility with "start /wait".

Set_FDCC_LGPO.exe v1.06, Visual C++ project sources

Aaron Margosis — Wed, 15 Apr 2009 19:29:00 GMT

Visual Studio 2005 project files and source code for Set_FDCC_LGPO.exe v1.06 is attached to this blog post.

[Removed, as a newer version is available -- bookmark the landing page for the most up-to-date-links.]

Set_FDCC_LGPO updated: v1.06

Aaron Margosis — Wed, 15 Apr 2009 19:08:00 GMT

Set_FDCC_LGPO has been updated to reflect the updated GPO content on NIST's download page. The FDCC settings have not changed. The updates contain only corrections to the downloads to more closely adhere to the FDCC settings.

The updated Set_FDCC_LGPO is attached to this blog post. (This time I also remembered to include the readme.htm in the zip file.) The updated Visual C++ project sources are here.

To recap: Set_FDCC_LGPO is a non-interactive tool that applies the Q1 2009 FDCC desktop policy settings from NIST to local group policy and optionally to the security settings of the computer as well.

[Attachment removed, as a newer version is available -- bookmark the landing page for the most up-to-date-links.]

Apply_LGPO_Delta v1.01, source code

Aaron Margosis — Thu, 19 Mar 2009 08:27:00 GMT

Visual Studio 2005 project and source code files for Apply_LGPO_Delta v1.01 is attached to this blog post.

[Attachment removed, as a newer version is available -- bookmark the landing page for the most up-to-date-links.]

Apply_LGPO_Delta updated, v1.01

Aaron Margosis — Thu, 19 Mar 2009 08:13:00 GMT

Apply_LGPO_Delta is a utility for automating the management of local group policy -- administrative templates and security templates. First posted here, it has been updated with the same fix that was applied to Set_FDCC_LGPO to prevent the 0x80070020 sharing-violation error from occurring.

Documentation is in the download. The sample starter files have been updated, including the addition of a security template you can use to revert the file system permissions changes that FDCC mandates on XP.

Updated source code is here.

[Attachment removed, as a newer version is available -- bookmark the landing page for the most up-to-date-links.]

Set_FDCC_LGPO.exe v1.05, source code

Aaron Margosis — Sat, 24 Jan 2009 06:20:00 GMT

Visual Studio 2005 project files and source code for Set_FDCC_LGPO.exe v1.05 is attached to this blog post.

(This blog doesn't support multiple file attachments per post...)

[Attachment removed, as a newer version is available -- bookmark the landing page for the most up-to-date-links.]

Set_FDCC_LGPO updated: v1.05

Aaron Margosis — Sat, 24 Jan 2009 06:07:00 GMT

[2009-04-15: Attachment removed. Bookmark this page for the latest versions of these utilities.]

The utility for applying FDCC configuration settings en masse to a computer has been updated:

The 0x80070020 sharing-violation error code that occasionally occurred appears to be due to contention over the registry.pol files between Set_FDCC_LGPO (which is writing to them) and winlogon.exe, which is reading from them to apply their contents to local policy. Upon a sharing-violation error, Set_FDCC_LGPO no longer reports an error right away, but retries the operation every half second for up to 10 seconds. This should dramatically reduce if not eliminate these errors.
The output log (use the /log command line option) now formats output in the same format that is consumed by Apply_LGPO_Delta, which will make it much easier to create input files to automate those variances.

The GPOs it applies are still those of the FDCC Major Version 1.0 (Q3 2008).

The updated source code is here. The original documentation still applies.

Set_FDCC_LPGO v1.04 (Q3 2008) - Source code

Aaron Margosis — Sat, 28 Jun 2008 07:25:00 GMT

The source code and Visual Studio project files for the Set_FDCC_LGPO Q3 2008 update are included as an attachment to this post.

To build the project, you need Visual Studio 2005 and the Windows SDK. The current NIST FDCC policy files are included in the attachment; to build with updated policy files, the attachment includes a PowerShell script to collect files from a locally-extracted copy of the NIST GPO files. That script needed to be modified from the previous version, as the folder structure for the NIST GPOs has since been renamed, and earlier assumptions by the script no longer hold. Details are described in the .ps1 script and the new .cmd batch file that are included. Since the files have already been collected (in the "res" folder), you won't need to perform those steps to build the project anyway.

Source code is provided "AS-IS" without warranty, and is not supported by Microsoft customer support.

[Attachment removed, as a newer version is available -- bookmark the landing page for the most up-to-date-links.]

Set_FDCC_LGPO: Updated for 2008 Q3

Aaron Margosis — Sat, 28 Jun 2008 07:16:00 GMT

[2009-04-15: Attachment removed. Bookmark this page for the latest versions of these utilities.]

Set_FDCC_LGPO is a utility that we originally released in December that applies the Group Policy Objects provided by NIST on their web site to the Local Group Policy on the Windows XP or Windows Vista computer you run the tool on.

NIST recently released FDCC Major Version 1.0 (Q3 2008), and so this utility has also been updated to incorporate the new GPOs. The updated utility is provided as an attachment to this blog post.

This update also incorporates improved logging of its SecEdit.exe results. The updated source code and project files for this release have also been posted. (For the time being, it's still a Visual Studio 2005 project.)

See the earlier post for documentation.

Apply_LGPO_Delta 1.0 - source code

Aaron Margosis — Wed, 07 May 2008 23:49:00 GMT

The source code and Visual Studio project files for the Apply_LGPO_Delta utility are included at an attachment to this post.

To build the project, you need Visual Studio 2005 or 2008 and the Windows SDK.

Source code is provided "AS-IS" without warranty, and is not supported by Microsoft customer support.

[Attachment removed, as a newer version is available -- bookmark the landing page for the most up-to-date-links.]

Apply_LGPO_Delta 1.0: utility to apply custom changes to Local Policy

Aaron Margosis — Wed, 07 May 2008 23:40:00 GMT

[2009-04-15: Attachment removed. Bookmark this page for the latest versions of these utilities.]

Apply_LGPO_Delta v1.0 is a non-interactive tool that is designed to help make automated changes to Local Group Policy. It can make changes to registry-based policy as well as apply security templates. The primary intended scenario is to apply custom changes to FDCC policies after having applied those policies to Local Group Policy using a tool such as Set_FDCC_LGPO.

The utility requires administrative rights, and runs only on Windows XP Service Pack 2 or higher, or Windows Vista (RTM or higher). If the utility is run without admin rights or on an unsupported platform, an error message is displayed in a message box dialog.

More information is available in the documentation (Apply_LGPO_Delta.htm) included in the zip file attached to this blog post. The zip file also includes the utility, a set of starter input files representing common requested changes, and a batch file demonstrating command line syntax and conditional execution following Set_FDCC_LGPO.

Source code in the form of a Visual Studio 2005 VC++ project is available here.

Webcast for upcoming Local GPO tool

Aaron Margosis — Fri, 25 Apr 2008 23:32:00 GMT

Updated, 28 April 2008

We're preparing a new utility for public release and will be demonstrating it in a webcast on Thursday, May 8, 2008 ~~Tuesday, April 29, 2008~~, 2:30pm Eastern time.

The utility is called Apply_LGPO_Delta, and makes it possible to automate custom changes to local group policy. It is intended to be used in conjunction with Set_FDCC_LGPO: After you run Set_FDCC_LGPO to apply all the NIST GPO settings to local group policy, you can run Apply_LGPO_Delta to make specific changes to those settings.

Updated 28 April 2008, 11:51pm EDT:

Click here to register for the webcast.

(The webcast was postponed from its original date because of technical problems with the event registration site. The issues have now been fixed. Sorry for the inconvenience.)

Set_FDCC_LGPO: Updated for 2008 Q1

Aaron Margosis — Sat, 23 Feb 2008 07:21:00 GMT

[2009-04-15: Attachment removed. Bookmark this page for the latest versions of these utilities.]

Set_FDCC_LGPO is a utility that we released in December that applies the Group Policy Objects provided by NIST on their web site to the Local Group Policy on the Windows XP or Windows Vista computer you run the tool on.

As NIST has recently updated those GPOs, this utility has also been updated to incorporate the new GPOs. The updated utility is provided as an attachment to this blog post.

The source code is unchanged, except for:

The version numbers, copyrights, etc., have been updated (it's now version 1.02).
The registry.pol and GptTmpl.inf files have been updated from the newer NIST download.

See the earlier post for documentation.