18.8.21.3 Ensure 'Configure registry policy processing: Process even if the Group Policy objects have not changed' is set to 'Enabled: TRUE'

Information

The 'Process even if the Group Policy objects have not changed' option updates and reapplies policies even if the policies have not changed.

The recommended state for this setting is: Enabled: TRUE (checked).

Rationale:

Setting this option to true (checked) will ensure unauthorized changes that might have been configured locally are forced to match the domain-based Group Policy settings again.

Impact:

Group Policies will be reapplied even if they have not been changed, which could have a slight impact on performance.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled, then set the Process even if the Group Policy objects have not changed option to TRUE (checked):

Computer Configuration\Policies\Administrative Templates\System\Group Policy\Configure registry policy processing

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template GroupPolicy.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative Templates (or newer).

Default Value:

Disabled. (Group policies are not reapplied if they have not been changed.)

See Also

https://workbench.cisecurity.org/files/4286

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-2, CSCv7|5.4

Plugin: Windows

Control ID: a18c8e7104488657ff7c486908a317c19ff974896ced240e5f158d4ee65fa541