salt.modules.win_lgpo_reg¶

salt.modules.win_lgpo_reg.delete_value(key, v_name, policy_class='Machine', write_registry=None, refresh_policy=False)¶

Delete a key/value pair from the Registry.pol file. This bypasses the admx/adml style policies. This is the equivalent of setting the policy to Not Configured.

Parameters:

• key (str) -- The registry key path

• v_name (str) -- The registry value name within the key

• policy_class (str, optional) --

  The registry class to write to. Can be one of the following:

  • Computer

  • Machine

  • User

  Default is Machine.

• write_registry (bool, optional) --

  Controls whether the registry value is also deleted immediately after updating Registry.pol.

  • None (default): auto-detect. Skips the registry delete on Domain Controllers; deletes directly on all other machine types.

  • True: always delete from the registry (non-DC behaviour).

  • False: always skip the registry delete; the Group Policy engine will remove the value on the next refresh.

• refresh_policy (bool, optional) --

  When True, trigger a native in-process Group Policy refresh via userenv.dll after successfully writing Registry.pol.

  Note

  The refresh is asynchronous. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use get_rsop_value() to verify applied state.

  Default is False.

Raises:

• SaltInvocationError -- Invalid policy_class

• CommandExecutionError -- On failure

Returns:

True if successful, otherwise False None: Key/value not present

Return type:

bool

CLI Example:

# Delete all values under a key
salt '*' lgpo_reg.delete_value "SOFTWARE\MyKey" "MyValue"

salt.modules.win_lgpo_reg.disable_value(key, v_name, policy_class='machine', write_registry=None, refresh_policy=False)¶

Mark a registry value for deletion in the registry.pol file. This bypasses the admx/adml style policies. This is the equivalent of setting the policy to Disabled in the Group Policy editor (gpedit.msc)

Parameters:

• key (str) -- The registry key path

• v_name (str) -- The registry value name within the key

• policy_class (str, optional) --

  The registry class to write to. Can be one of the following:

  • Computer

  • Machine

  • User

  Default is Machine.

• write_registry (bool, optional) --

  Controls whether the registry value is also deleted immediately after updating Registry.pol.

  • None (default): auto-detect. Skips the registry delete on Domain Controllers; deletes directly on all other machine types.

  • True: always delete from the registry (non-DC behaviour).

  • False: always skip the registry delete; the Group Policy engine will remove the value on the next refresh.

• refresh_policy (bool, optional) --

  When True, trigger a native in-process Group Policy refresh via userenv.dll after successfully writing Registry.pol.

  Note

  The refresh is asynchronous. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use get_rsop_value() to verify applied state.

  Default is False.

Raises:

• SaltInvocationError -- Invalid policy_class

• CommandExecutionError -- On failure

Returns:

True if successful, otherwise False None: If already disabled

Return type:

bool

CLI Example:

# Delete a value
salt '*' lgpo_reg.delete_value "SOFTWARE\MyKey" "MyValue"

salt.modules.win_lgpo_reg.get_key(key, policy_class='Machine')¶

Get all the values set in a key in the Registry.pol file.

Parameters:

• key (str) -- The registry key where the values reside

• policy_class (str, optional) --

  The registry class to read from. Can be one of the following:

  • Computer

  • Machine

  • User

  Default is Machine.

Raises:

SaltInvocationError -- Invalid policy class

Returns:

A dictionary containing the value data and the value type

Return type:

dict

CLI Example:

# Get all values from a key
salt '*' lgpo_reg.get_key "SOFTWARE\MyKey"

salt.modules.win_lgpo_reg.get_rsop_value(key, v_name)¶

Query the Resultant Set of Policy (RSoP) for a specific Machine registry key/value. Returns information about the winning Group Policy Object (GPO) for that value, including whether it is managed by a Domain GPO.

Note

Only Machine (computer) policy is supported. User policy RSoP requires per-user SID scoping and a different WMI namespace, which is not practical when Salt runs as SYSTEM.

Parameters:

• key (str) -- The registry key path

• v_name (str) -- The registry value name

Returns:

A dictionary containing the RSoP information, or {} if the value is not found in RSoP, if the machine is not domain-joined, or if WMI is unavailable. Keys when a result is found:

• key (str): The registry key path

• name (str): The registry value name

• data: The value data

• type (str): The registry value type (e.g. REG_DWORD)

• gpo_id (str): The GUID of the winning GPO

• gpo_name (str): The display name of the winning GPO

• precedence (int): The policy precedence (1 = winning)

• domain_managed (bool): True if managed by a Domain GPO

Return type:

dict

CLI Example:

salt '*' lgpo_reg.get_rsop_value "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" VulnerableChannelAllowList

salt.modules.win_lgpo_reg.get_value(key, v_name, policy_class='Machine')¶

Get the value of a single value pair as set in the Registry.pol file.

Parameters:

• key (str) -- The registry key where the value name resides

• v_name (str) -- The value name to retrieve

• policy_class (str, optional) --

  The registry class to read from. Can be one of the following:

  • Computer

  • Machine

  • User

  Default is Machine.

Raises:

SaltInvocationError -- Invalid policy class

Returns:

A dictionary containing the value data and the value type found

Return type:

dict

CLI Example:

# Get a value
salt '*' lgpo_reg.get_value "SOFTWARE\MyKey" "MyValue"

salt.modules.win_lgpo_reg.read_reg_pol(policy_class='Machine')¶

Read the contents of the Registry.pol file. Display the contents as a human-readable dictionary.

Parameters:

policy_class (str, optional) --

The registry class to retrieve. Can be one of the following:

• Computer

• Machine

• User

Default is Machine.

Raises:

SaltInvocationError -- Invalid policy class

Returns:

A dictionary representing the contents of the Registry.pol file

Return type:

dict

CLI Example:

# Read the machine Registry.pol
salt '*' lgpo_reg.read_reg_pol

salt.modules.win_lgpo_reg.refresh_policy()¶

Trigger a native in-process Machine Group Policy refresh.

Delegates to salt.utils.win_lgpo_reg.refresh_policy(). Use this after a batch of set_value / disable_value calls made with refresh_policy=False to commit all policy changes in a single pass.

Note

This call is asynchronous. It signals the Group Policy service to begin processing the local Registry.pol file, but returns before that processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use get_rsop_value() to verify the applied state after the refresh has had time to complete.

Returns:

True if the refresh signal was accepted successfully

Return type:

bool

CLI Example:

salt '*' lgpo_reg.refresh_policy

salt.modules.win_lgpo_reg.set_value(key, v_name, v_data, v_type='REG_DWORD', policy_class='Machine', write_registry=None, refresh_policy=False)¶

Add a key/value pair to the registry.pol file. This bypasses the admx/adml style policies. This is the equivalent of setting a policy to Enabled

Parameters:

• key (str) -- The registry key path

• v_name (str) -- The registry value name within the key

• v_data (str) -- The registry value

• v_type (str, optional) --

  The registry value type. Must be one of the following:

  • REG_BINARY

  • REG_DWORD

  • REG_EXPAND_SZ

  • REG_MULTI_SZ

  • REG_QWORD

  • REG_SZ

  Default is REG_DWORD.

• policy_class (str, optional) --

  The registry class to write to. Can be one of the following:

  • Computer

  • Machine

  • User

  Default is Machine.

• write_registry (bool, optional) --

  Controls whether the value is also written to the live registry immediately after updating Registry.pol.

  • None (default): auto-detect. Skips the registry write on Domain Controllers where HKLM\\SOFTWARE\\Policies\\ is write-protected; writes directly on all other machine types.

  • True: always write to the registry (non-DC behaviour).

  • False: always skip the registry write; the Group Policy engine will commit the value on the next refresh.

• refresh_policy (bool, optional) --

  When True, trigger a native in-process Group Policy refresh via userenv.dll after successfully writing Registry.pol.

  Note

  The refresh is asynchronous. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use get_rsop_value() to verify applied state.

  Default is False.

Raises:

• SaltInvocationError -- Invalid policy_class

• SaltInvocationError -- Invalid v_type

• SaltInvocationError -- v_data doesn't match v_type

Returns:

True if successful, otherwise False.

Return type:

bool

CLI Example:

# Set REG_DWORD value (default)
salt '*' lgpo_reg.set_value "SOFTWARE\MyKey" "MyValue" 1

# Set REG_SZ value
salt '*' lgpo_reg.set_value "SOFTWARE\MyKey" "MyValue" "string value" "REG_SZ"

salt.modules.win_lgpo_reg.write_reg_pol(data, policy_class='Machine')¶

Write data to the Registry.pol file. The data is a dictionary that is then converted to the appropriate bytes format expected by Registry.pol

Parameters:

• data (dict) -- A dictionary containing Registry.pol data

• policy_class (str, optional) --

  The registry class to write to. Can be one of the following:

  • Computer

  • Machine

  • User

  Default is Machine.

Raises:

• SaltInvocationError -- Invalid policy class

• CommandExecutionError -- On failure

Returns:

True if successful

Return type:

bool

CLI Example:

# Write to Machine Registry.pol
salt '*' lgpo_reg.write_reg_pol "{'SOFTWARE\MyKey': {'MyValue': 'data': 1, 'type': 'REG_DWORD'}}"