HKCU Registry Keys and Intune

The Toolkit General Discussion
1

So I have been tasked with hiding certain control panel icons. I have modified the Deploy-Application.ps1 file to do everything I want.

In the Install steps it does this

$RegSettings = {
                Set-RegistryKey -Key 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCPL' -Name 'Security and Maintenance' -Value 'Security and Maintenance'
                Set-RegistryKey -Key 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'DisallowCPL' -Value 1 -Type 'DWord'
                }
    
            # Invoke the registry settings for all users
                Invoke-HKCURegistrySettingsForAllUsers -RegistrySettings $RegSettings

In the Uninstall steps it does this

$RemoveRegSettings = { 
            Remove-RegistryKey -Key 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Recurse
            }
    
            # Invoke the registry settings for all users
            Invoke-HKCURegistrySettingsForAllUsers -RegistrySettings $RemoveRegSettings

This is my detection rule for the application

$Path = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"

Try {
    # Check if the registry key exists
    $RegistryKey = Get-Item -Path $Path -ErrorAction Stop
    If ($RegistryKey) {
        Write-Output "Detected"
        Exit 0
    } 
    Exit 1
} 
Catch {
    Exit 1
}

When I run the Deploy-Application.exe from commandline on my machine, the relevant registry keys are created and are removed with the uninstall switch.

When I package this up into an intune win file for intune, The application runs successfully, The detection script exits with code 0

image
image927×655 185 KB

But the keys are not created.

I dont know why this is the case. Im using the same installation command on my own machine but the keys are not created on my intune device

Anyone have any ideas?

Thanks

2

The first thing that springs to mind is how are you targetting the application deployment in Intune User or System?
If you are not specifically choosing user, it will default to System…
As such, as you are applying those registry keys to HKCU, this will likely be applied to the System account, not the logged on user
I guess you could check the registry to see if those keys are set below the System account to confirm my theory

1 Like
3

Well I was doing it in system context.

To my understanding choosing in user context means it wont run as admininstrator? Correct me if Im wrong here.

Running the application with user rights means the registry keys wont get created.

4

Apologies, I didn’t read your post thorougly enough :grin:
It looks like you are doing the correct thing to apply these settings to all Users registry settings.
However, I wonder if the order of the registry key creation here might be the issue - I think the 2nd Set-Registry line should be first, as the 1st Set-Registry line is trying to add a key below the DisallowCPL key that may not exist (until the 2nd line has been run)

So I think you could try this:

$RegSettings = {
                Set-RegistryKey -Key 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'DisallowCPL' -Value 1 -Type 'DWord'
                Set-RegistryKey -Key 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCPL' -Name 'Security and Maintenance' -Value 'Security and Maintenance'
                }

Just an idea :person_shrugging:

5

I ended up doing this with remediation instead which has worked. Would be good to know though regardless.

Ill keep testing stuff. Thanks

1 Like
6 
 [scriptblock]$HKCURegistrySettings = {
         Set-RegistryKey -Key "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCPL'" -Name "Security and Maintenance" -Value "Security and Maintenance" -Type String -SID $UserProfile.SID -ContinueOnError $false
        Set-RegistryKey -Key "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "DisallowCPL'" -Value "DWord" -Type DWord -SID $UserProfile.SID -ContinueOnError $false
 }
 Invoke-HKCURegistrySettingsForAllUsers -RegistrySettings $HKCURegistrySettings
7

As above - you were missing the -SID $UserProfile.SID bit there!

BTW your detection rule is looking at HKCU for the system account, so the original version would not work for new users logging on. A remediation script in pure user context sounds like the better approach.

8

Hello - I put the below function and code to update HKCU when logged in as System. seems to work

# Function to add or modify registry key for the current user
function AddOrUpdateRegistryKeyForCurrentUser {
    param (
        [string]$RegistryPath,
        [string]$Name,
        [string]$Value,
        [string]$Type = "String"
    )

    # Create the HKU drive if it doesn't exist
    if (-not (Get-PSDrive -Name HKU -ErrorAction SilentlyContinue)) {
        New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS
    }

    # Get the SID of the logged-in user
    $UserSID = (Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.Special -eq $false -and $_.Loaded -eq $true }).SID

    # Construct the full registry path
    $FullRegistryPath = "HKU:\$UserSID\$RegistryPath"


    # Add or update the registry property
    New-ItemProperty -Path $FullRegistryPath -Name $Name -Value $Value -PropertyType $Type -Force
}

# Define the registry paths, names, and values for the two keys
$RegistryPath = "PAth"
$Name1 = "Name"
$Value1 = "String"

$Name2 = "Name"
$Value2 = "String"

# Call the function to add or update the first registry key
AddOrUpdateRegistryKeyForCurrentUser -RegistryPath $RegistryPath -Name $Name1 -Value $Value1

# Call the function to add or update the second registry key
AddOrUpdateRegistryKeyForCurrentUser -RegistryPath $RegistryPath -Name $Name2 -Value $Value2