SCEP 2012 SP1 - User could disable recommanded default actions
-
Tuesday, February 05, 2013 12:53 PM
Hello,
With System Center Configuration Manager 2012 SP1, the user has access to the following option on the client (all the users are local administrator of the computer) :
How to update the policy in order to disable this option for the users as the screenshoot below ?
Thank's for your help and feel free to ask if some information are missing.
Follow me on Twitter http://www.twitter.com/liontux | My Blog (French/English) : http://security.sakuranohana.fr/
All Replies
-
Tuesday, February 05, 2013 2:33 PM
Try setting the following registry value:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Antimalware
DWORD - DisableRoutinelyTakingAction = 0
There doesn't seem to be a way to set this through editing the policy, but placing it in this area of the registry will cause it to apply like a policy. You could probably set it automatically through a Compliance setting (formerly DCM)
- Proposed As Answer by Derek Gary Tuesday, February 05, 2013 4:37 PM
- Marked As Answer by Lionel LEPERLIERMVP Wednesday, February 06, 2013 4:14 PM
-
Tuesday, February 05, 2013 3:15 PM
This option work fine but is there a way to push it through an option on the SCEP policies ?
PS : is there a web page referencing all the registry key and their action ?
Follow me on Twitter http://www.twitter.com/liontux | My Blog (French/English) : http://security.sakuranohana.fr/
-
Tuesday, February 05, 2013 4:19 PM
It doesn't look like it can be set through the SCEP policy. However, you should be able to set it automatically with a Compliance setting. Check out Kent's blog for a good example of how to do this with a registry setting:
I can't find any registry key reference specific to SCEP, but most of the info for FEP 2010 still applies. If you use the ADMX reference here
http://technet.microsoft.com/en-us/library/gg412481.aspx
and the admin template files available here
http://www.microsoft.com/en-us/download/details.aspx?id=13088
You can probably find what you're looking for. For example, the DisableRoutinelyTakingAction reg key equates to the "Turn on routine remediation" setting.
-
Tuesday, February 05, 2013 9:14 PM
After trying to use a compliance setting to set the reg value, I found that it doesn't work as expected on a 64-bit system. When it remediates the registry value, it sets a REG_QWORD value instead of REG_DWORD. SCEP doesn't recognize the QWORD, only the DWORD. After some more searching I found a thread describing a similar problem and the poster found that the only way to successfully set the value was to use a script remediation action instead of a direct registry remediation action:
- Marked As Answer by Lionel LEPERLIERMVP Wednesday, February 06, 2013 4:14 PM
-
Monday, March 04, 2013 10:27 AM
For information it seems to be specified to the french version of the UI here's another strange behavior.
Follow me on Twitter http://www.twitter.com/liontux | My Blog (French/English) : http://security.sakuranohana.fr/
.png)
