# Changing Group Policy Setting in Windows XP **URL:** \ **Category:** Factual Questions\ **Created:** [January 15, 2010, 2:41am UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031 "2010-01-15T02:41:05Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![ice1000](https://avatars.discourse-cdn.com/v4/letter/i/a3d4f5/32.png) [@ice1000](https://boards.straightdope.com/u/ice1000)\ **Post date:** [January 15, 2010, 2:41am UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/1 "2010-01-15T02:41:05Z")
My laptop’s security log is getting full of access events where NETWORK SERVICE is listening for incoming traffic. The audit policy for ‘Audit object access’ is set for failure and I want to disable it. It fails because the windows firewall is preventing connection. When I go to the GPO editor the checkboxes for changing the settings are grayed out. My id on the laptop is a member of the administrators group. How can I disable the auditing of these events? ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [January 15, 2010, 3:02am UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/2 "2010-01-15T03:02:01Z")
Is it a domain member? ---
**Author:** ![ice1000](https://avatars.discourse-cdn.com/v4/letter/i/a3d4f5/32.png) [@ice1000](https://boards.straightdope.com/u/ice1000)\ **Post date:** [January 15, 2010, 4:24am UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/3 "2010-01-15T04:24:10Z")
Yes, it is. ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [January 15, 2010, 5:02am UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/4 "2010-01-15T05:02:08Z")
If it’s set in a domain group policy you won’t be able to change it locally. ---
**Author:** ![ice1000](https://avatars.discourse-cdn.com/v4/letter/i/a3d4f5/32.png) [@ice1000](https://boards.straightdope.com/u/ice1000)\ **Post date:** [January 15, 2010, 6:52am UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/5 "2010-01-15T06:52:38Z")
Ahh, that could be it. The only person that can change it is a domain admin? ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [January 15, 2010, 2:17pm UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/6 "2010-01-15T14:17:20Z")
Yes. ---
**Author:** ![HorseloverFat](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@HorseloverFat](https://boards.straightdope.com/u/HorseloverFat)\ **Post date:** [January 15, 2010, 2:59pm UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/7 "2010-01-15T14:59:19Z")
\>When I go to the GPO editor the checkboxes for changing the settings are grayed out. When its grayed out it means you do not have permission because it is inheriting a domain policy. If youre a local admin you can get around this, but considering its a work laptop you’re best leaving it alone. ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [January 15, 2010, 5:19pm UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/8 "2010-01-15T17:19:49Z")
> [@HorseloverFat](#): > > \>When I go to the GPO editor the checkboxes for changing the settings are grayed out. > > When its grayed out it means you do not have permission because it is inheriting a domain policy. If youre a local admin you can get around this, but considering its a work laptop you’re best leaving it alone. Even if you’re a local admin, any changes will be reset the next time that the machine connects to the domain. ---
**Author:** ![HorseloverFat](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@HorseloverFat](https://boards.straightdope.com/u/HorseloverFat)\ **Post date:** [January 15, 2010, 5:27pm UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/9 "2010-01-15T17:27:21Z")
Yep, but a startup script fixes that. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [January 15, 2010, 5:45pm UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/10 "2010-01-15T17:45:36Z")
> [@HorseloverFat](#): > > Yep, but a startup script fixes that. The settings will be re-applied from the domain GPO not only at startup, but periodically at 90 minute intervals (assuming the default policy is left alone). There are some settings that don’t process in the background, like Software Installation and Folder Redirection, but the audit settings are not among them. You can specify an update rate from 0 to 64,800 minutes, or disable it entirely, at the GPO, but I can’t quite picture how a local admin’s startup script could stop the process. Could you explain? ---
**Author:** ![HorseloverFat](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@HorseloverFat](https://boards.straightdope.com/u/HorseloverFat)\ **Post date:** [January 15, 2010, 5:52pm UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/11 "2010-01-15T17:52:01Z")
I forgot about the interval. Okay, schedule it every x mins via the built in schedular or use a script. Assuming the user knows the reg key that needs to change: apply.ahk loop { sleep 60000 RegWrite, _insert key and data here_ } Compile that as an .exe and put it in startup. Local admins need to be non-local admins or permissions taken from those keys explicitly if you want security. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [January 15, 2010, 7:13pm UTC](https://boards.straightdope.com/t/changing-group-policy-setting-in-windows-xp/525031/12 "2010-01-15T19:13:10Z")
> [@HorseloverFat](#): > > I forgot about the interval. Okay, schedule it every x mins via the built in schedular or use a script. This reduces the problem but doesn’t eliminate it. If the refresh kicks off at 10:06, and your script doesn’t run until 10:09, he’s got three minutes worth of wrong audit settings in existence.