none
Configuration Baseline "Compliant" but no Enforcement RRS feed

  • Question

  • I've written a relatively simple Configuration Item & Baseline that's set to toggle a Registry integer from the default (3) to a new value (8).  The intention is to disable the WebEx Addin in Outlook.  I have configured two Compliance Rules in a single Configuration Item, one to check for the existence of the Registry key, the other to "remediate" the change.

    My testing has resulted in clients receiving the CI and reporting back as compliant, but no change is made to the registry.  What am I missing? 

    I had a series of screen captures setup to share as well, but I'm unable to post them until TechNet is "able to verify my account".  I'll add them to the thread once this process is complete. 

    Thanks,

    Rob

    Wednesday, January 30, 2019 5:36 PM

Answers

  • I didn't go through the trouble because the verification message states it includes links as well as images.  

    However, I am swinging back to this to mark the issue as resolved.  I ended up scratching my original CI and built a new one from scratch.  I don't know what I did differently, but the new one worked as intended and I was able to duplicate it for all 4 related MS Office apps (as I had intended).  

    Since I have also since received another "verification" from MSDN, I figured I'd try to post an image to verify, here goes!


    • Marked as answer by Admin_Rob Friday, February 8, 2019 8:31 PM
    Friday, February 8, 2019 8:31 PM

All replies

  • This blog will help you get pictures. https://www.enhansoft.com/blog/problems-posting-pictures-and-images-or-urls-to-the-technet-forums

    How exactly is your CI configured? Are you sure it is NOT setting the Regkey for the local system account vs the logon user? 


    Garth Jones

    Blog: https://www.enhansoft.com/blog Old Blog: https://sccmug.ca/

    Twitter: @GarthMJ Book: System Center Configuration Manager Reporting Unleashed

    Wednesday, January 30, 2019 6:42 PM
    Moderator
  • What registry value *exactly* do you have configured to check in the CI?

    Are you checking a registry key or value? There is a difference. What most folks commonly (and mistakenly) call keys are in fact, not keys, but values.


    Jason | https://home.configmgrftw.com | @jasonsandys

    Wednesday, January 30, 2019 6:52 PM
  • I waited patiently for MSDN to verify my account, came back here and still get the "Body text cannot contain images or links until we are able to verify your account" message.  I'll try to convey my situation better using words....

    I do think the problem is related to writing the key to HKCU vs HKLM.  I have done this successfully in the past with HKLM so I might be missing something with HKCU.  

    The Registry Key is: HKCU:Software\Microsoft\Office\Outlook\Addins\WebExOI.Addin

    Value: LoadBehavior

    Looking at this Setting, I have 2 Compliance rules. 

    Rule 1: Checks that the value defined above exists

    Rule 2: Checks the value of LoadBehavior "Equals" the value: 0

    Remediate noncompliant rules when supported is unchecked for Rule 1 and checked for Rule 2

    Report noncompliance if this setting instance is not found is unchecked for both rules 

    In the big picture I want to create 4 of these CI's, one for Outlook (above), Word, Powerpoint and Excel.  I would then apply all 4 CI's to a single Configuration Baseline.  However, as of now, I am only testing with a single CI.  Thanks in advance for your assistance.  

    Wednesday, February 6, 2019 8:02 PM
  • I waited patiently for MSDN to verify my account, came back here and still get the "Body text cannot contain images or links until we are able to verify your account" message.  I'll try to convey my situation better using words....

    How about uploading your screenshots to a file sharing service and just linking to them here?


    Jason | https://home.configmgrftw.com | @jasonsandys

    Thursday, February 7, 2019 1:35 AM
  • I didn't go through the trouble because the verification message states it includes links as well as images.  

    However, I am swinging back to this to mark the issue as resolved.  I ended up scratching my original CI and built a new one from scratch.  I don't know what I did differently, but the new one worked as intended and I was able to duplicate it for all 4 related MS Office apps (as I had intended).  

    Since I have also since received another "verification" from MSDN, I figured I'd try to post an image to verify, here goes!


    • Marked as answer by Admin_Rob Friday, February 8, 2019 8:31 PM
    Friday, February 8, 2019 8:31 PM
  • It worked!

    I should note that the screenshot does show a version of my CI that was pointing to HKLM, this was an early iteration of my attempt, and  modifying it to HKCU without rebuilding from scratch (as I finally did) was likely the culprit to my issue.  Thanks,

    Rob

    Friday, February 8, 2019 8:33 PM