-
Title
Removing Agent GPO from default domain policy or default domain controller policy -
Description
It is not suggested to modify the default domain policy or default domain controller policy by placing the Agent GPO into one of these. Instead, create a new GPO at the domain level and set it to override the default settings in the default policies. If the Agent GPO was created in the default domain policy or default domain controller policy and the necessity arises to remove it, these are the steps that might be completed to accomplish that task.
Please note that because this is not a suggested practice, these steps are provided, but not endorsed. Use at your own risk.
-
Resolution
There are a couple of ways to remove all of the GPO settings created by the KACE GPO Provisioning Tool:
- Restore the Default Domain Policy and Default Domain Controllers Policy to their default states using a backup.
- Microsoft dcgpofix tool. This tool resets the default domain policy and/or the default domain controllers policy back to factory defaults. This will remove all customizations made to the default domain policy GPO including those made outside of the KACE GPO Provisioning Tool. This tool is built into Windows Server OS's. Details for the tool can be found here: https://technet.microsoft.com/en-us/library/hh875588.aspx
Also included in the above link is Microsoft's best practices for configuring the Default Domain Policy. "As a best practice, you should configure the Default Domain Controllers Policy GPO only to set user rights and audit policies."
- 3rd party tool called Registry Workshop. The Registry Workshop application can directly modify and remove the changes made by the KACE GPO Provisioning Tool. A registry.pol file is created under C:\Windows\SYSVOL\domain\Policies\{GUID}\MACHINE directory. You would be able to open this file with the Registry Workshop editor and delete the entries here referencing the KACE Agent installation. This tool can be found here: http://www.torchsoft.com/en/rw_information.html
Note: All of these methods are outside of the KACE SMA product, so we do not have any support available for either of the above options. Use at your own risk.