Where in the registry can I find the current setting of an IE8 policy?

Question

I have set the following policy with gpedit in a Windows Server 2008 machine that has IE8:

I have a source that tells me that configuration resides in HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoExtensionManagement -- but that's a lie. There isn't even an Internet Explorer folder under Software\Policies\Microsoft.

Moreover, the same source says the setting is under "Computer Configuration\Network\Internet Explorer\Do Not Allow Users to enable or Disable Add-Ons" on gpedit. As you see above, that isn't true either.

OK, the "source" I'm talking about is the US Government: http://usgcb.nist.gov/usgcb/download_ie8.html -- namely, their IE8 OVAL definitions.

So, where in the registry is that setting?

Answer 1

It is an either/or. The policy can be implemented via the registry OR the GPO. You'll find your GPO where it is set in something like:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{71DA9274-FD7B-4660-A801-B013570D3F5F}Machine\Software\Policies\Microsoft\Internet Explorer\Restrictions

or

HKEY_USERS\S-1-5-21-2090352725-1269969352-1905203885-2959\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{71DA9274-FD7B-4660-A801-B013570D3F5F}Machine\Software\Policies\Microsoft\Internet Explorer\Restrictions

though the GPO itself is stored on disk, and not the registry ... I think here:

%systemroot%\System32\GroupPolicy

As far as where you'll find various settings in gpedit - it does depend on your version of windows.