Windows – ny way to control “Device Installation Restrictions” via the Registry (instead of Group Policy) for users on Windows Home Editions

group-policywindows 10windows-registry

We have group policy restrictions in place to prevent device installation for certain hardware IDs (see below), but group policy is only available for Windows Pro/Ultimate editions and not Windows Home. I’ve looked into adding Group Policy to Windows Home via 3rd party solutions (such as the one found here), however it is not a complete up-to-date version of Group Policy and is missing the options for “Device Installation Restrictions”. I’m also slightly hesitant to deploy 3rd party group policy solutions on my client’s machines.

Group Policy Location: (Computer Configuration -> Administrative Templates -> System -> Device Installation -> Device Installation Restrictions -> Prevent installation of devices that match any of these Device IDs)

I looked into achieving the same functionality via the registry, and seem to have found at least some of the registry keys used to control this via Group Policy, but when I manually edit them, it does not work properly. Part of this may have to do with the GUIDs created in the registry under “Group Policy Objects” (see below picture). Is anyone familiar with creating group policy objects via the registry and getting them to remain persistent?

            Registry Location shown below: HKCU -> Software -> Microsoft -> Windows -> CurrentVersion -> Group Policy Objects

The keys which are affected by the standard “Group Policy Device Installation Restrictions” are:

Device Installation Restrictions: HKCU -> Software -> Microsoft -> Windows -> CurrentVersion -> Group Policy Objects -> GUID (unsure how this is generated) -> Software -> Policies -> Microsoft -> Windows -> DeviceInstall -> Restrictions -> DenyDeviceIDs

EDIT

The reg keys you pointed to below do indeed control this set of group policy objects. Big help, thanks!

Interestingly enough, when I configure the proper reg keys on 2 identical Surface Pro 4 tablets, I can control “Device Installation Restrictions” on one machine which I previously configured “Device Installation Restrictions” on through the official Group Policy UI (gpedit). Setting these keys you referenced through the registry and rebooting (or running gpupdate.exe /force through Command Prompt) does work and cause the specific device to become enabled/disabled.

When I configure the same set of keys on another Surface Pro 4, which has never had group policy set through the Group Policy UI (gpedit), this tablet will not reflect the reg changes live, even after rebooting or running gpupdate.exe /force. It seems as though something else may be controlling this? Both are Windows Pro, so all the proper group policy components should exist on this machine.

Any ideas here? It seems like there is another registry setting perhaps which may control something here?

Best Answer

As far as I can tell, the Group Policy Objects branch is only a cache of the active GPOs. Windows actually checks this Registry location for computer policy settings:

HKLM\SOFTWARE\Policies

For the Prevent installation of devices that match any of these Device IDs setting, Group Policy uses this key:

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions

The DenyDeviceIDs DWORD is set to 1 when the policy is Enabled. The DenyDeviceIDsRetroactive DWORD corresponds to the Also apply to matching devices that are already installed checkbox: 1 for checked, 0 for not.

The restricted entries are kept in a subkey of Restrictions that also is named DenyDeviceIDs. One value on that key is one restriction. Each value's name should be the same as its data.

Tip: I found this information using the Element Inspector tool in my own open-source application, Policy Plus.

You'll need to reboot for the changes to take effect.

Note that even if you set all the Registry settings exactly right, it's possible that Home editions might not respect them. Most Group Policy settings work just fine on all editions, but there are a few that don't; the components that make use of them might not be there on Home. If you find that these settings don't work, you'll need to upgrade to Pro.

Related Solutions

Windows – No automatic driver installation after upgrade to Windows 10: The installation of this device is forbidden by system policy

There is a chance that registry keys of the policy still remain in the registry. Open regedit as an admin, and go to:

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall

If you see DeviceInstall folder, delete it (it's safe, because it's not there by default). Now, restart your computer and see if the problem still persists.

Update:

Windows shows a default behavior in each case. In our example, it's driver installation. By default, windows applies no restrictions to installation of legitimate drivers, so configuring the group policy to NOT restrict the driver installation makes no difference. But, in this case, and I have no idea why on the earth, windows default behavior has changed to restrict driver installation, which means not configuring group policy, no longer means no restriction. So, there are 2 ways to fix this:

Group policy: Set Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions\Prevent installation of devices not described by other policy settings to Disabled

Registry: This is the manual way, that does the exact same as above, but doesn't show up in group policy. However, changing the group policy later, will change this value. Open regedit as admin and go to:

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions

If you don't find DeviceInstall create it, and also create Restrictions as it's sub-folder (to correspond the registry key above). Now, add this registry key here and restart:

Key Name: DenyUnspecified
Key Type: REG_DWORD
Key Value: 0

Windows – Can’t disable Windows Defender via Group Policy or the Registry

I found the solution. It turns out that Windows Defender is so ingrained within Windows 10 that it comes with its own "anti-tamper" protection.

This does two things: prevents you from creating the registry key in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender by giving you a generic error message and also renders the group policy change ineffective.

In order to disable this, I had to follow these instructions:

Go to Virus & threat protection
Click on Manage Settings
Turn off Tamper Protection
Proceed to enable the group policy Turn off Windows Defender Antivirus in Computer Configuration/Administrative Templates/Windows Components/Windows Defender Antivirus or add the registry key.
Restart PC

Best Answer

Related Solutions

Windows – No automatic driver installation after upgrade to Windows 10: The installation of this device is forbidden by system policy

Windows – Can’t disable Windows Defender via Group Policy or the Registry

Related Question