18.9.19.3 (L1) Ensure 'Configure registry policy processing: Process even if the Group Policy objects have not changed' is set to 'Enabled: TRUE'

Information

The 'Process even if the Group Policy objects have not changed' option updates and reapplies registry policies even if the registry policies have not changed.

This setting affects all registry policy settings within the Administrative Templates folder and any other policies that store values in the registry.

The recommended state for this setting is: Enabled: TRUE (checked).

Setting this option to true (checked) will ensure unauthorized local changes are reverted to match the domain-based Group Policy settings.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled then set the Process even if the Group Policy objects have not changed option to TRUE (checked):

Computer Configuration\Policies\Administrative Templates\System\Group Policy\Configure registry policy processing

Note: This Group Policy path is provided by the Group Policy template GroupPolicy.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative Templates (or newer).

Impact:

Group Policy settings within the Administrative Templates folder (and other policies that store values in the registry) will be reapplied even if they have not been changed, which may cause Group Policy refreshes to take longer.

See Also

https://workbench.cisecurity.org/benchmarks/17610