Microsoft 365 Admin templates only apply to current user (Win10 Home)

[binomnom]

Hi there,
very strange issue.
I'm trying to set macro execution policies on some Windows 10 Home boxes (22H2). Using PolicyPlus June 2021 snapshot.
Specifically User/Microsoft Excel 16/Excel Options/Security/Trust Center/...
... Macro Notification Settings
...Turn off trusted documents
... Prevent Excel from running XLM macros
which should all be registry-based policies.

All local, no Domain no nothing.

I have donwloaded the ADMX/ADML files from Microsoft, and tried two different approaches of using the templates with PolicyPlus:

1. Open ADMX folder from file menu
2. Copy ADMX/L files to C:\Windows\PolicyDefinitions

Then, I have tried two different approaches to apply the policies:

1. Open and save changes to local GPO
2. Open and save changes to live local registry

On the local admin account, the policies apply immediately without logoff, and work as expected. But no matter what I do, on a local unprivileged account, the policies have no effect whatsoever. Sometimes opening PolicyPlus on that account shows the settings enabled in the local GPO, but not in the registry. Sometimes even the GPO does not show as set.

Tried logon / -off as well as reboot, and even gpupdate /force to no avail. Any help greatly appreciated!

---

EDIT:
Did some more digging. It really seems like the Local GPO / .pol-File (C:\Windows\System32\GroupPolicy\User\Registry.pol) doesn't get applied to users on login. The file is there, and PolicyPlus tells me that a policy has been enabled, but it's not reflected in the current users hive. Does PolicyPlus apply the policies to the HKCU Registry as well as the GPO on save when GPO is opened? That would explain why it works for the admin account I execute PP from.

As a workaround, I can use the SID lookup tool under "User GPO" to get the user's SID, and then open the correct Registry hive by entering HKEY_USERS\$SID in the Local Registry box. But that's a manual process that has to be done for each user on the machine that should have the policy applied, so not ideal.

[Fleex255]

Thanks for the detailed troubleshooting steps!

Does PolicyPlus apply the policies to the HKCU Registry as well as the GPO on save when GPO is opened?

Yes. Home editions are missing the component that applies the local GPO to the Registry, so Policy Plus has to simulate that step. Currently that is only done for the current user.

There is not really a good way for Policy Plus to run when any (potentially new) user logs on in order to apply policies, but as a risky (!) workaround, you could try modifying the template user hive, C:\Users\Default\ntuser.dat. You can either mount that file yourself to use a Local Registry source or select the Default user hive in Policy Plus. I have not tested this specifically and any errors could break user creation, so please try in a test environment or VM first. Changing this file should affect all new users, but not any other existing ones.

[binomnom]

Thank you very much for taking the time to reply, Ben!
You have perfectly answered everything that I didn't quite understand before.
I know that my question was only tangentially related to Policy Plus (which is awesome by the way!), so I truly appreciate the help. This was just the only place I felt like people could help me. Somehow, this information is very hard to come by, and not by lack of trying.

There is not really a good way for Policy Plus to run when any (potentially new) user logs on in order to apply policies

That makes complete sense. It's also not something I'd expect it to do.

as a risky (!) workaround, you could try modifying the template user hive [...] Changing this file should affect all new users, but not any other existing ones.

Great to know, thank you!

Home editions are missing the component that applies the local GPO to the Registry, so Policy Plus has to simulate that step. Currently that is only done for the current user.

Considering how much I struggled to find that piece of information, would you be willing to add it to the readme, just as another place for people to find it?

Again, thank you so much! Take care!

[Fleex255]

Very good point, I see how the README was confusing here. I've updated it. Thanks!