Registry Keys for Windows XP Policy Restrictions

In Windows XP, Group Policy administrative templates (.adm files) enforce user and machine restrictions by writing specific values to designated locations within the Windows Registry. This article outlines the primary registry keys where these standard administrative policy restrictions are stored, explains the distinction between user and computer scopes, and describes how Windows XP distinguishes true policies from persistent system modifications.

The Four Primary Policy Registry Branches

Windows XP reserves four specific registry trees for standard policy restrictions. Administrative templates write restrictions almost exclusively into these paths:

1. HKEY_LOCAL_MACHINE\Software\Policies
   Stores computer-level configurations and restrictions for standard components, applications, and operating system modules.

2. HKEY_CURRENT_USER\Software\Policies
   Stores user-level configurations and restrictions for standard components and applications, applying only to the currently logged-on user profile.

3. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies
   Stores system-wide operating system and core shell restrictions, affecting all accounts on the workstation (e.g., system shutdown rights, logon behaviors).

4. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
   Stores user-specific shell and interface restrictions (e.g., hiding desktop icons, disabling the Task Manager, removing the Run command).

Subkeys for Common Restrictions

Within the ...\CurrentVersion\Policies branches, Windows XP groups restrictions under functional subkeys:

• ...\Policies\Explorer: Governs shell and desktop behaviors, such as disabling the Control Panel (NoControlPanel), removing the Run dialog (NoRun), or hiding specific drives.
• ...\Policies\System: Contains security and task controls, such as disabling the Task Manager (DisableTaskMgr) or the Registry Editor (DisableRegistryTools).
• ...\Policies\Network: Holds policies regarding network configurations, mapped drives, and connection settings.
• ...\Policies\ActiveDesktop: Enforces desktop background locks and Active Desktop limitations.

True Policies vs. Registry Tattooing

The four locations listed above are the only registry paths recognized by Windows XP as "true policy" branches.

When an administrative template writes to these designated keys, the changes are recognized as temporary policy states. If the governing Group Policy Object (GPO) is removed or set to "Not Configured," Windows XP automatically deletes the corresponding keys and restores default behavior.

If a custom administrative template writes restriction values to registry locations outside of these four designated branches, the changes cause "registry tattooing." In those cases, removing the policy from Group Policy does not remove the restriction from the registry; it must be manually deleted or reversed using an administrative script.