script to enable GPO setting

[Briandr]

Hi,

I am looking for a script that can enable the following GPO:

Allow non-administrators to install drivers for these device setup classes.

I found this code in another thread. I am hopeful something like this can be used for the setting I am trying to change.

This disables changing home page settings (User ConfigurationAdministrative TemplatesWindows ComponentsInternet Explorer) - Enable

run(@comspec & " /c gpedit.msc")
WinWaitActive("Group Policy")
send("{down 8}{right}")
sleep(1000)
send("{down}{right}")
sleep(1000)
send("{down 2}{tab}")
sleep(1000)
send("{down 11}")
sleep(1000)
send("!ar")
WinWaitActive("Disable changing home page settings Properties")
send("!e")
ControlClick("Disable changing home page settings Properties", "", "Button6" )

I know what the sleep is doing is I am just not sure of the sends. I assume they are mouse clicks or keyboard movements.

Any help adjusting this code would be appreciated. Thanks.

Edited October 10, 2013 by Briandr

[water]

Send Sends simulated keystrokes to the active window.

Run Au3Recorder and let it create the AutoIt script for you while you change the setting in GPEdit.

[Briandr]

Hi,

Thanks for the information. Do I need to adjust this after running Au3Recorder so that when it is runs with on a system where the user does not have admin rights? I can push the compiled EXE so it runs under the System context. So maybe I don't need to adjust the script??

[water]

Why do you set the GPO on the client side? Wouldn't it be easier/safer to do it on the server side?

[Briandr]

I would agree it would make more sense to do it this way. Not sure why an AD OU's can't be tweaked. Its not like its a non AD shop, but I am not sure if all of the computers are in AD. Trust me I don't like the bang head on wall approach.

Edited October 10, 2013 by Briandr

[water]

Do I need to adjust this after running Au3Recorder so that when it is runs with on a system where the user does not have admin rights? I can push the compiled EXE so it runs under the System context. So maybe I don't need to adjust the script??

At least "#RequireAdmin" needs to be added to the script.