# Windows - Setting local group policies

**URL:** <https://forum.ansible.com/t/windows-setting-local-group-policies/7978>\
**Category:** Get Help\
**Tags:** windows\
**Created:** [August 20, 2024, 7:28am UTC](https://forum.ansible.com/t/windows-setting-local-group-policies/7978 "2024-08-20T07:28:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ewaldbervoets](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ewaldbervoets/32/4526_2.png) [@ewaldbervoets](https://forum.ansible.com/u/ewaldbervoets)\
**Post date:** [August 20, 2024, 7:28am UTC](https://forum.ansible.com/t/windows-setting-local-group-policies/7978/1 "2024-08-20T07:28:21Z")

</div>

Hi all, windows sys admin noob here so apologies if this is a really dumb question!

I’m trying to configure/restrict a non-admin Windows user using Ansible. Since local group policies in Windows are just registry keys, I tried using the win\_regedit module to set registry keys in HKCU. I haven’t had success doing this and keep getting “Access Denied” (which makes sense to me because the user should not be able to edit these registry keys himself).

How would I best restrict a non-admin Windows user so that I can, for example, disable the control panel for that user?

I know the right path to the registry:

```auto
HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel

```

but I haven’t found a way to make it work.

Has anyone done something like this that can point me in the right direction?

---

<div class="post-metadata">

**Author:** ![ewaldbervoets](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ewaldbervoets/32/4526_2.png) [@ewaldbervoets](https://forum.ansible.com/u/ewaldbervoets)\
**Post date:** [August 22, 2024, 12:03pm UTC](https://forum.ansible.com/t/windows-setting-local-group-policies/7978/2 "2024-08-22T12:03:02Z")

</div>

Ended up being able to do it with win\_powershell module like this:

```auto
      $userProfile = "C:\Users\{{ user }}"
      $regHive = "HKU\TempHive"
      $regPath = "$regHive\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
      reg load $regHive "$userProfile\NTUSER.DAT" | Out-Null
      REG ADD $regPath /v NoControlPanel /t REG_DWORD /d 1 /f
      reg unload $regHive | Out-Null

```

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [August 22, 2024, 7:11pm UTC](https://forum.ansible.com/t/windows-setting-local-group-policies/7978/3 "2024-08-22T19:11:27Z")

</div>

Just an FYI the `win_regedit` module has a `hive` option that can load the hive in that task allowing you to set whatever you need in the loaded hive.

---

<div class="post-metadata">

**Author:** ![ewaldbervoets](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ewaldbervoets/32/4526_2.png) [@ewaldbervoets](https://forum.ansible.com/u/ewaldbervoets)\
**Post date:** [August 23, 2024, 7:42am UTC](https://forum.ansible.com/t/windows-setting-local-group-policies/7978/4 "2024-08-23T07:42:29Z")

</div>

I tried it like this but without success:

```auto
  win_regedit:
    hive: 'C:\Users\{{ user }}\NTUSER.DAT'
    path: 'HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel'
    name: 'NoControlPanel'
    data: 1
    type: dword

```

Should that have worked? Also tried setting it with the `become`, but kept getting `Access Denied` errors (which made sense to me since the user should not be able to change group policy this registry key)

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [August 25, 2024, 8:22pm UTC](https://forum.ansible.com/t/windows-setting-local-group-policies/7978/5 "2024-08-25T20:22:36Z")

</div>

The hive is loaded under `HKLM:\ANSIBLE` as per the documentation for `hive` [1]

> This hive is loaded under the HKLM:\ANSIBLE key which can then be used in _name_ like any other path.

This means that your path would look like `path: HKLM:\ANSIBLE\Software\Policies\Microsoft\Internet Explorer\Control Panel`.

[1] [ansible.windows.win\_regedit module – Add, change, or remove registry keys and values — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_regedit_module.html#parameter-hive)

---

<div class="post-metadata">

**Author:** ![ewaldbervoets](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ewaldbervoets/32/4526_2.png) [@ewaldbervoets](https://forum.ansible.com/u/ewaldbervoets)\
**Post date:** [August 29, 2024, 10:58am UTC](https://forum.ansible.com/t/windows-setting-local-group-policies/7978/6 "2024-08-29T10:58:16Z")

</div>

unfortunately, this didn’t work for me:

```auto
  win_regedit:
    hive: 'C:\Users\{{ user }}\NTUSER.DAT'
    path: 'HKLM:\ANSIBLE\Software\Policies\Microsoft\Internet Explorer\Control Panel'
    name: "NoControlPanel"
    data: 1
    type: dword

```

I think it’s because the key should be present in HKCU and not HKLM. But thanks for the help, not sure what I’m missing here to get this to work

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [August 29, 2024, 6:43pm UTC](https://forum.ansible.com/t/windows-setting-local-group-policies/7978/7 "2024-08-29T18:43:23Z")

</div>

The hive specified by `hive` is loaded into `HKLM:\ANSIBLE` so any changed under there will edit that hive. It’s the same as your `reg load` example except that you chose to load it under `HKU:\TempHive`. The `HKCU` key is just a helper shortcut that refers to the current user’s hive, so by editing `C:\Users\foo\NTUSER.DAT` you’ll be editing `HKCU` for the `foo` user when they log in again.