FrontMotion

I have been thinking about the problem where some people want to deploy user settings on top of computer settings. The issue in the past that made it a show stopper is which one takes precedence. If the user setting did, then users can easily bypass proxy, etc. If the computer setting did, then admins can't override proxy settings only on their account.

So, I am proposing an idea. have computer settings take precedence, but also have a computer setting key that specifies what group can override computer settings.

Thoughts?

DraconPern wrote:I have been thinking about the problem where some people want to deploy user settings on top of computer settings. The issue in the past that made it a show stopper is which one takes precedence.

Would Group Policy loopback processing provide enough flexibility to bypass the problem? Make user settings always take precedence in your code, so admins can use the User side of a GPO to override the Group side, but then admins can use loopback processing to further override the User side as needed.

Loopback processing of Group Policy

DraconPern wrote:If the user setting did, then users can easily bypass proxy, etc.

I don't follow. As an unprivileged user, I don't have permission to make changes under HKCU\Software\Policies. If I've got admin rights, I can just install my own copy of Firefox, change the system proxy settings, change DNS, etc.; the game is already over. Am I missing something?

Hmm.. you are right. Let me go back to some email/forum posts and see what was the issue before..