File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/win_lgpo_reg.cpython-310.pyc
Back
o ;j�` � @ s� d Z ddlZddlZddlZdZdd� Zdd� Zdd � Zdd d �Z ddd�Z ddd�Z ddd�Z dd� Z dS )a1 LGPO - Registry.pol =================== .. versionadded:: 3006.0 A state module for working with registry based policies in Windows Local Group Policy (LGPO). This module contains functions for working with the ``Registry.pol`` file. The ``Registry.pol`` file is the source of truth for registry settings and LGPO. Group Policy is refreshed every 90 seconds by default. During that refresh the contents of the ``Registry.pol`` file are applied to the Registry. If the setting is changed outside of Group Policy to something other than what is contained in the ``Registry.pol`` file, it will be changed back during the next refresh. In the Group Policy Editor (``gpedit.msc``) these policies can be set to three states: - Not Configured - Enabled - Disabled A policy that is "Not Configured" does not have an entry in the ``Registry.pol`` file. A Group Policy refresh will not make any changes to key/value pairs in the registry that are not specified in the ``Registry.pol`` file. An "Enabled" policy will have an entry in the ``Registry.pol`` files that contains its key path, value name, value type, value size, and value data. When Group Policy is refreshed, existing values will be overwritten with those contained in the ``Registry.pol`` file. A "Disabled" policy will have an entry in the ``Registry.pol`` file with the key path and the value name, but the value name will be prepended with ``**del.``. When Group Policy is refreshed the key/value will be deleted from the registry. If the key contains no values, it will also be deleted. Working with LGPO Reg --------------------- The easiest way to figure out the values needed for this module is to set the policy using the Group Policy Editor (``gpedit.msc``) and then run the ``lgpo_reg.read_reg_pol`` function. This function will display a dictionary of all registry-based policies in the ``Registry.pol`` file. From its return you can get the ``key``, ``v_name``, ``v_type``, and ``v_data`` required to configure that policy. .. note:: Not all policies in the Group Policy Editor (``gpedit.msc``) that write to the registry make that change in the ``Registry.pol`` file. Those policies could still be enforced via the ``Registry.pol`` file... theoretically. But you will have to find the values needed to set them with this module using a different method. � NZlgpo_regc C s t jj�� sdS dtvrdS tS )z8 Only works on Windows with the lgpo_reg module )Fz)LGPO_REG State: Only available on Windows�lgpo_reg.get_value)Fz-LGPO_REG State: lgpo_reg module not available)�salt�utils�platformZ is_windows�__salt__�__virtualname__� r r �L/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/win_lgpo_reg.py� __virtual__@ s r c C sd |dkrdS dt vr dS t d | |d�}|�d�r0|�d�p#|�dd�}d | � d |� d |� d �S dS ) z� Return a warning string if a Domain GPO manages the given key/value, else None. Only checked for Machine policy (User RSoP is not queryable from SYSTEM context). �MachineNzlgpo_reg.get_rsop_value)�key�v_nameZdomain_managedZgpo_nameZgpo_id�unknownz Warning: '�\z!' is also managed by Domain GPO 'z>'. Changes may be overridden on the next Group Policy refresh.)r �get)r �name� policy_classZrsopZ gpo_labelr r r �_get_domain_gpo_warningM s �r c C s6 t |||d�}|r| d r| d d | n|| d< | S )z� Append a domain GPO warning to ret['comment'] if a Domain GPO manages the given key/value. Returns ret for use directly in return statements. �r r r �comment� )r )�retr r r �warningr r r �_append_domain_warning` s r Tc C s� t d | ||d�}|r|�| |d�� i }|dkrF|rFtd d| |d�}|d d ur0|d |d < |d d ur<|d |d < |rF|�| |d�� ||d �S )z@ Helper function to get the current state of the policy r )r r r )r r r zreg.read_valueZHKLM)Zhiver ZvnameZvdataN�dataZvtype�type)�pol�reg)r �updateZ __utils__)r r r �write_registryr r Zreg_rawr r r � _get_currentk s � r � REG_DWORDr Fc C s� |� � dv r d}nd}|du rtjj�� }| i ddd�}t|| ||d�}t|�d i ��d d��t| �koRt|�d i ��d d��t|�koRt|�d i ��d d��|k} |dksY|s\d } n,t|�di ��d d��t| �ko�t|�di ��d d��t|�ko�|�di ��d d�|k} g } | r�| �d� | r�|dkr�|r�| �d� t d r�| s�| �d� | s�|dkr�|r�| �d� d� | �|d< | r�| r�d |d< nd|d< t ||| |d�S | r�| r�d� | �|d< d |d< t ||| |d�S t d || |||||d� t|| ||d�} tjj �|| �|d< g } |d �r�t| �d i ��d d��t| �k�o<t| �d i ��d d��t|�k�o<| �d i ��d d�|k} |dk�sE|�sHd } n.t| �di ��d d��t| �k�out| �di ��d d��t|�k�ou| �di ��d d�|k} | �r�d |d �di �v �r�| �d � n| �d � | �r�|dk�r�|�r�d|d �di �v �r�| �d � n| �d � | �r�| �r�d |d< n-| �d |� d!�� | �d"|� �� | �d#| � �� | �d$|� �� | �d%|� �� d|d< d� | �|d< t ||| |d�S )&a� Ensure a registry setting is present in the Registry.pol file. Args: name (str): The registry value name within the key key (str): The registry key path v_data(str): The registry value v_type (str): The registry value type. Must be one of the following: - REG_BINARY - REG_DWORD - REG_EXPAND_SZ - REG_MULTI_SZ - REG_QWORD - REG_SZ Default is REG_DWORD policy_class (str): The registry class to write to. Can be one of the following: - Computer - Machine - User Default is ``Machine`` write_registry (bool, optional): Controls whether the value is also written to the live registry immediately after updating ``Registry.pol``. - ``None`` (default): auto-detect. Skips the registry write on Domain Controllers where ``HKLM\\SOFTWARE\\Policies\\`` is write-protected; writes directly on all other machine types. - ``True``: always write to the registry (non-DC behaviour). - ``False``: always skip the registry write; the Group Policy engine will commit the value on the next refresh. refresh_policy (bool, optional): When ``True``, trigger a native in-process Group Policy refresh via ``userenv.dll`` after successfully writing ``Registry.pol``. .. note:: The refresh is **asynchronous**. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use ``lgpo_reg.get_rsop_value`` to verify applied state. Default is ``False``. CLI Example: .. code-block:: yaml # Using the name parameter in the definition set_reg_pol_value: lgpo_reg.value_present: - key: SOFTWARE\MyKey - name: MyValue - v_type: REG_SZ - v_data: "some string data" - policy_class: Machine # Using the name as the parameter and modifying the User policy MyValue: lgpo_reg.value_present: - key: SOFTWARE\MyKey - v_type: REG_SZ - v_data: "some string data" - policy_class: User �Zcomputer�machiner �UserNF� �r �changes�resultr �r r r r r r r r Tr z Policy value already presentz Registry value already present�testzPolicy value will be setzRegistry value will be setr r r( r zlgpo_reg.set_value)r r �v_data�v_typer r �refresh_policyr' �newzPolicy value setzFailed to set policy valuezRegistry value setz Failed to set registry valuezFailed to set � policy value�- key: �- name: z - v_data: z - v_type: )�lowerr r � win_functions�is_domain_controllerr �strr �append�__opts__�joinr r r �recursive_diff) r r r+ r, r r r- r �old� pol_correct� reg_correctr r. r r r � value_present� s� V� �� �� ��� � " ��" �� � � �r= c C s� |� � dv r d}nd}|du rtjj�� }| i ddd�}t|| ||d�}|d �d d�d | � �k}|dks8|s;d }n|d i k}g } |rJ| �d� |rW|dkrW|rW| �d� td r�|sb| �d� |so|dkro|ro| �d� d� | �|d< |r|rd |d< nd|d< t ||| |d�S |r�|r�d� | �|d< d |d< t ||| |d�S t d || |||d� t|| ||d�} tjj � || �|d< g } |d �r%| d �d d�d | � �k}|dks�|s�d }n| d i k}|r�d |d �di �v r�| �d� n| �d � |�r|dk�r|�rd |d �di �v �r| �d � n| �d � |�r$|�r$d |d< n | �d |� d �� | �d!|� �� | �d"| � �� d|d< d� | �|d< t ||| |d�S )#a� Ensure a registry setting is disabled in the Registry.pol file. Args: key (str): The registry key path name (str): The registry value name within the key policy_class (str): The registry class to write to. Can be one of the following: - Computer - Machine - User Default is ``Machine`` write_registry (bool, optional): Controls whether the registry value is also deleted immediately after updating ``Registry.pol``. - ``None`` (default): auto-detect. Skips the registry delete on Domain Controllers; deletes directly on all other machine types. - ``True``: always delete from the registry (non-DC behaviour). - ``False``: always skip the registry delete; the Group Policy engine will remove the value on the next refresh. refresh_policy (bool, optional): When ``True``, trigger a native in-process Group Policy refresh via ``userenv.dll`` after successfully writing ``Registry.pol``. .. note:: The refresh is **asynchronous**. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use ``lgpo_reg.get_rsop_value`` to verify applied state. Default is ``False``. CLI Example: .. code-block:: yaml # Using the name parameter in the definition set_reg_pol_value: lgpo_reg.value_disabled: - key: SOFTWARE\MyKey - name: MyValue - policy_class: Machine # Using the name as the parameter and modifying the User policy MyValue: lgpo_reg.value_disabled: - key: SOFTWARE\MyKey - policy_class: User r" r r$ NFr% r& r) r r z**del.Tr z Policy value already disabled� Registry value already deletedr* z Policy value will be disabled� Registry value will be deletedr r r( r zlgpo_reg.disable_value�r r r r r- r' r. zPolicy value disabledz Failed to disable policy value�Registry value deleted� Failed to delete registry valuezFailed to disable r/ r0 r1 )r2 r r r3 r4 r r r6 r7 r8 r r r r9 � r r r r r- r r: r; r< r r. r r r �value_disabledQ s� C� ���� � � �rD c C s� |� � dv r d}nd}|du rtjj�� }| i ddd�}t|| ||d�}|d i k}|dks1|s4d }n|d i k}g } |rC| �d � |rP|dkrP|rP| �d � td r�|s[| �d� |sh|dkrh|rh| �d� d�| �|d< |rx|rxd |d< nd|d< t ||| |d�S |r�|r�d�| �|d< d |d< t ||| |d�S t d || |||d� t|| ||d�} tjj � || �|d< g } |d �r| d i k}|dks�|s�d }n| d i k}|r�d |d � di �v r�| �d� n| �d� |�r|dk�r|�rd |d � di �v �r| �d� n| �d � |�r|�rd |d< n | �d |� d �� | �d |� �� | �d | � �� d|d< d�| �|d< t ||| |d�S )!a� Ensure a registry setting is not present in the Registry.pol file. Args: key (str): The registry key path name (str): The registry value name within the key policy_class (str): The registry class to write to. Can be one of the following: - Computer - Machine - User Default is ``Machine`` write_registry (bool, optional): Controls whether the registry value is also deleted immediately after updating ``Registry.pol``. - ``None`` (default): auto-detect. Skips the registry delete on Domain Controllers; deletes directly on all other machine types. - ``True``: always delete from the registry (non-DC behaviour). - ``False``: always skip the registry delete; the Group Policy engine will remove the value on the next refresh. refresh_policy (bool, optional): When ``True``, trigger a native in-process Group Policy refresh via ``userenv.dll`` after successfully writing ``Registry.pol``. .. note:: The refresh is **asynchronous**. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use ``lgpo_reg.get_rsop_value`` to verify applied state. Default is ``False``. CLI Example: .. code-block:: yaml # Using the name parameter in the definition set_reg_pol_value: lgpo_reg.value_absent: - key: SOFTWARE\MyKey - name: MyValue - policy_class: Machine # Using the name as the parameter and modifying the User policy MyValue: lgpo_reg.value_absent: - key: SOFTWARE\MyKey - policy_class: User r" r r$ NFr% r& r) r Tr z Policy value already deletedr> r* z Policy value will be deletedr? r r r( r zlgpo_reg.delete_valuer@ r' r. zPolicy value deletedz Failed to delete policy valuerA rB zFailed to remove r/ r0 r1 )r2 r r r3 r4 r r6 r7 r8 r r r r9 r rC r r r � value_absent� s� C� ���� � � �rE c C sT | i ddd�}t d rd|d< d|d< |S td � r$d |d< d |d< |S d |d< |S ) uz Trigger a Machine Group Policy refresh. This is an imperative state — it fires a refresh signal every run. Use it at the end of a block of ``value_present`` / ``value_disabled`` states that were applied with ``refresh_policy: False`` to commit all policy changes in a single GP refresh pass. .. note:: This state does not assert a persistent desired configuration. It signals the Group Policy service to process the current ``Registry.pol`` file. Registry values will be updated **asynchronously** after the service completes its refresh cycle. To verify the applied state, run ``lgpo_reg.get_rsop_value`` after allowing the refresh to complete. The recommended pattern on Domain Controllers is to write all policy values with ``refresh_policy: False``, then seal the batch with a single ``lgpo_reg.refresh_policy`` state using ``require``: .. code-block:: yaml set_appx_policy: lgpo_reg.value_present: - key: SOFTWARE\\Policies\\Microsoft\\Windows\\Appx - name: AllowAllTrustedApps - v_type: REG_DWORD - v_data: 0 - refresh_policy: False set_smartscreen_policy: lgpo_reg.value_present: - key: SOFTWARE\\Policies\\Microsoft\\Windows\\System - name: EnableSmartScreen - v_type: REG_DWORD - v_data: 1 - refresh_policy: False apply_local_policy: lgpo_reg.refresh_policy: - name: apply_local_policy - require: - lgpo_reg: set_appx_policy - lgpo_reg: set_smartscreen_policy Args: name (str): Arbitrary identifier for the state (not used functionally). Returns: dict: Standard state return with ``result`` indicating whether the refresh signal was accepted. Fr% r& r* Nr( z'Group Policy refresh would be triggeredr zlgpo_reg.refresh_policyTz+Group Policy refresh triggered successfullyzGroup Policy refresh failed)r7 r )r r r r r r- � s 5 �r- )T)r! r NF)r NF)�__doc__Zsalt.utils.datar Zsalt.utils.platformZsalt.utils.win_functionsr r r r r r= rD rE r- r r r r �<module> s4 8 � P � ) � &
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings