Comments on: Preventing Domain Group Policies from Applying

By: AyuanX

AyuanX — Wed, 03 Aug 2011 03:59:26 +0000

OK, I think I’ve found it. For Windows 7 x64:

Original gpsvc.dll

.text:000007FF76495000 ; public: static int CSKU::IsDomainIncapableSystem(void)
.text:000007FF76495000 ?IsDomainIncapableSystem@CSKU@@SAHXZ proc near
.text:000007FF76495000 ; CODE XREF: DllGetClassObject:loc_7FF7649AFBFp
.text:000007FF76495000 ; CGroupPolicySession::ApplyGroupPolicyForPrincipal(void *,void *,void *):loc_7FF764A18A0p …
.text:000007FF76495000
.text:000007FF76495000 arg_0 = dword ptr 8
.text:000007FF76495000 arg_8 = qword ptr 10h
.text:000007FF76495000
.text:000007FF76495000 ; FUNCTION CHUNK AT .text:000007FF764CC45C SIZE 0000001F BYTES
.text:000007FF76495000
.text:000007FF76495000 mov [rsp+arg_8], rbx
.text:000007FF76495005 push rdi
.text:000007FF76495006 sub rsp, 20h
.text:000007FF7649500A mov eax, cs:?s_dwTestNoDomainSystemCheckCount@@3KA ; ulong s_dwTestNoDomainSystemCheckCount

Patched gpsvc.dll

.text:000007FF76495000 ; public: static int CSKU::IsDomainIncapableSystem(void)
.text:000007FF76495000 ?IsDomainIncapableSystem@CSKU@@SAHXZ proc near
.text:000007FF76495000 ; CODE XREF: DllGetClassObject:loc_7FF7649AFBFp
.text:000007FF76495000 ; CGroupPolicySession::ApplyGroupPolicyForPrincipal(void *,void *,void *):loc_7FF764A18A0p …
.text:000007FF76495000
.text:000007FF76495000 arg_0 = dword ptr 8
.text:000007FF76495000 arg_8 = qword ptr 10h
.text:000007FF76495000
.text:000007FF76495000 ; FUNCTION CHUNK AT .text:000007FF764CC45C SIZE 0000001F BYTES
.text:000007FF76495000
.text:000007FF76495000 xor eax,eax
.text:000007FF76495000 inc eax
.text:000007FF76495005 retn
.text:000007FF76495006 sub rsp, 20h
.text:000007FF7649500A mov eax, cs:?s_dwTestNoDomainSystemCheckCount@@3KA ; ulong s_dwTestNoDomainSystemCheckCount

By: Your Fan

Your Fan — Wed, 03 Aug 2011 01:59:56 +0000

Is there a patch for Windows 7 x64?

Thank you.

By: Joshua

Joshua — Tue, 19 Oct 2010 18:22:13 +0000

@Rusco: If you check permissions on the key you will find deny access. Take ownership will work (you are Admin) and then you can change permissions to grant yourself access.

As an alternative, use the install CD to perform the modification. This logs you in as SYSTEM.

By: Rusco

Rusco — Thu, 23 Sep 2010 20:28:15 +0000

On win7 I can not stop the gpsvc service,it got started automatically (also the registry key can not be edited by me), therefore even if your patch would work with win7 it is not feasable without the possibility to stop the gpsvc service. Having a solution for that would be great !
Cheers
Rusco.

By: Tomas

Tomas — Wed, 19 May 2010 09:13:46 +0000

Great post! I’m so happy to be free from that “big brother”-service. Thank you!

By: Peter

Peter — Sat, 23 Jan 2010 19:21:03 +0000

Looking to patch the DLL on Windows 7 (64bit) system as well. I have gpsvc disabled for now but thats only a temporary solution. Would appreciate patch file for Win7! TIA!

By: steve

steve — Wed, 13 Jan 2010 13:06:46 +0000

Dear Friend!
This is great idea!
I would like to have it done for Windows 7 32bit and especially 64bit, but patch doesn´t work for gpsvc.dll
from this systems. Please could You try it?
I can email You these dlls.

Thanks

By: Remko

Remko — Tue, 21 Jul 2009 20:58:30 +0000

I never really looked at the way XP handles it, if I remember correctly there is some exe that handles Group Policy but it’s not a service.

By: dg

dg — Mon, 20 Jul 2009 16:30:03 +0000

hey any idea about how to accomplish the same goal on xp?

great post and great work. thanks.

By: dan hanke

dan hanke — Sat, 02 May 2009 03:08:09 +0000

What is the proper syntax to use RunAsSys?

Do I run it from the run menu item, command prompt or with a double click?
I have tired these but I’m at a loss as to how to run it.

RunAsSys.exe /services.msc
“RunAsSys.exe” services.msc
“RunAsSys.exe” -services.msc