Disabling Group Policy Editor via Microsoft "SteadyState" ADM prevents policy being edited in ZCC

  • 7001020
  • 24-Jul-2008
  • 27-Apr-2012

Environment

Novell ZENworks 10 Configuration Management ZENworks Control Center - ZCC
Novell ZENworks 10 Configuration Management Policies

Situation

Cannot edit existing Group Policy - GPEDIT does not initialize

Microsoft ADM file SCTSettings.adm in use, part of  "SteadyState" program.

"Disable System Tools and other management programs" enabled

Resolution

This is working as designed: when editing Group Policies, ZENworks will not remove settings which were in place before starting the editor, unless ZENworks has applied them itself. If you wish to use Microsoft's "SteadyState", or any other 3rd-party system that disables the use of Group Policy editing, it will be necessary for you to disable it on a machine in order to use ZENworks to edit policies.

As a workaround, do not use this setting, but instead, use the following standard settings:
- User Configuration | Administrative Templates | Windows Components | Microsoft Management Console | Restrict the user from entering author mode = Enabled
and
- User Configuration | Administrative Templates | Windows Components | Microsoft Management Console | Restricted/Permitted snap-ins | Group Policy | Group Policy Management = Disabled

Additional Information

Restricting the settings for editing Group Policies would normally prevent the administrator from editing an existing policy with these settings. ZCM recognizes the "standard" settings and temporarily removes them so the policy can be amended. The Microsoft SCTSettings.adm file is not recognized by ZCM, so it doesn't know to remove those settings.