user用户的组策略无法使用
我在深度的一个GHOST版本的user用户下无法打开gpedit.msc。显示您没用权限使用此操作。
对此是了不少方法，还是没有解决，有高手帮忙解决一下。谢谢。给出具体步骤。
[解决办法]
是配置系统允许普通用户打开 gpedit.msc ？还是 administrator 无法打开 gpedit.msc ？
[解决办法]
user用户是没有权限打开gpedit.msc的，除非你把该用户提升到管理员组，才有权限
[解决办法]
对于下列注册表项和文件设置权限，授予 users 组完全控制的权限。
HKEY_USERS\.Default
HKEY_LOCAL_MACHINE\System\CurrentControlSet
HKEY_CLASSES_ROOT
C:\WINDOWS\system32\gpedit.msc
经过测试，可以使普通用户打开 gpedit.msc。
[解决办法]
上面还少了一个：对 C:\WINDOWS\system32\GroupPolicy 目录配置 users 组完全控制的权限。
其实，上面的方法比较粗暴。通过 procmon 跟踪可以得到以下信息（这是普通用户打开 gpedit.msc 时被拒绝访问的对象）。
RegOpenKeyHKU\.DefaultACCESS DENIEDDesired Access: Read/Write
RegOpenKeyHKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\WinmmACCESS DENIEDDesired Access: All Access
RegCreateKeyHKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\WinmmACCESS DENIEDDesired Access: All Access
RegCreateKeyHKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\WinmmACCESS DENIEDDesired Access: All Access
RegCreateKeyHKU\.DEFAULT\Software\Microsoft\Multimedia\AudioACCESS DENIEDDesired Access: Write, Query Value
RegCreateKeyHKU\.DEFAULT\Software\Microsoft\Multimedia\AudioACCESS DENIEDDesired Access: Write, Query Value
RegCreateKeyHKU\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression ManagerACCESS DENIEDDesired Access: Write
RegCreateKeyHKU\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression ManagerACCESS DENIEDDesired Access: Write
RegCreateKeyHKU\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression ManagerACCESS DENIEDDesired Access: Write
RegCreateKeyHKU\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression ManagerACCESS DENIEDDesired Access: Write
RegOpenKeyHKU\.DEFAULT\softwareACCESS DENIEDDesired Access: Read/Write
RegOpenKeyHKU\.DEFAULT\softwareACCESS DENIEDDesired Access: Read/Write
RegOpenKeyHKU\.DEFAULT\softwareACCESS DENIEDDesired Access: Read/Write
RegOpenKeyHKU\.DEFAULT\softwareACCESS DENIEDDesired Access: Read/Write
RegOpenKeyHKU\.DEFAULT\softwareACCESS DENIEDDesired Access: Read/Write
RegSetValueHKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32\(Default)ACCESS DENIEDType: REG_SZ, Length: 62, Data: C:\WINDOWS\system32\oleacc.dll
RegSetValueHKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C\BaseClassACCESS DENIEDType: REG_SZ, Length: 12, Data: Drive
RegSetValueHKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\BaseClassACCESS DENIEDType: REG_SZ, Length: 12, Data: Drive
CreateFileC:\WINDOWS\system32\gpedit.mscACCESS DENIEDDesired Access: Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: None, AllocationSize: n/a
RegSetValueHKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppDataACCESS DENIEDType: REG_SZ, Length: 112, Data: C:\Documents and Settings\Default User\Application Data
CreateFileC:\Documents and Settings\Default User\Application Data\Microsoft\MMCACCESS DENIEDDesired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0
RegCreateKeyHKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy ObjectsACCESS DENIEDDesired Access: Maximum Allowed
lz 可以根据这些信息进行配置。
------解决方案--------------------
