利用组策略API 编辑GPO(Group Policy Object)

用windows自带的GPO Editor编辑修改，然后利用注册表监控器regFromApp监视注册表的改动，就知道某个策略修改了注册表的哪个字段了。

下面是禁止U盘访问的例子：

 

#include <gpedit.h>
#include <windows.h>
#include <objbase.h>
#include <comdef.h>
#include <sstream>
#include <iostream>

int main()
{
    DWORD val, val_size = sizeof(DWORD);
    HRESULT hr;
    IGroupPolicyObject* pLGPO;
    HKEY machine_key, dsrkey;
    // MSVC is finicky about these ones => redefine them
    const IID my_IID_IGroupPolicyObject =
    { 0xea502723, 0xa23d, 0x11d1, { 0xa7, 0xd3, 0x0, 0x0, 0xf8, 0x75, 0x71, 0xe3 } };
    const IID my_CLSID_GroupPolicyObject =
    { 0xea502722, 0xa23d, 0x11d1, { 0xa7, 0xd3, 0x0, 0x0, 0xf8, 0x75, 0x71, 0xe3 } };
    GUID ext_guid = REGISTRY_EXTENSION_GUID;
    // This next one can be any GUID you want
    GUID snap_guid = { 0x3d271cfc, 0x2bc6, 0x4ac2, { 0xb6, 0x33, 0x3b, 0xdf, 0xf5, 0xbd, 0xab, 0x2a } };

    // Create an instance of the IGroupPolicyObject class
    hr = CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
    if (FAILED(hr))
    {
        std::ostringstream errorStream;
        errorStream << "Failed to initialize COM library. Error code = 0x" << std::hex << hr << std::endl;
        std::cout << errorStream.str() << std::endl;
        return 0;
    }

    hr = CoCreateInstance(my_CLSID_GroupPolicyObject, NULL, CLSCTX_INPROC_SERVER,
        my_IID_IGroupPolicyObject, (LPVOID*)&pLGPO);

    // We need the machine LGPO (if C++, no need to go through the lpVtbl table)
    pLGPO->OpenLocalMachineGPO(GPO_OPEN_LOAD_REGISTRY);
    pLGPO->GetRegistryKey(GPO_SECTION_MACHINE, &machine_key);

    // The disable System Restore is a DWORD value of PoliciesMicrosoftWindowsDeviceInstallSettings
    RegCreateKeyEx(machine_key, "SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions",
        0, NULL, 0, KEY_SET_VALUE | KEY_QUERY_VALUE, NULL, &dsrkey, NULL);

    // Create the value
    val = 1;
    RegSetKeyValue(dsrkey, NULL, "DenyRemovableDevices", REG_DWORD, &val, sizeof(val));
    RegCloseKey(dsrkey);

    // Apply policy and free resources
    pLGPO->Save(TRUE, TRUE, &ext_guid, &snap_guid);
    RegCloseKey(machine_key);
    pLGPO->Release();
    return 0;
}

rereferences:

http://pete.akeo.ie/2011/03/porgramatically-setting-and-applying.html

http://www.nirsoft.net/utils/reg_file_from_application.html

http://blog.sina.com.cn/s/blog_4e0987310101irm8.html