Registry- Content Advisor

Clarifications

http://www.experts-exchange.com/Security/Operating_Systems_Security/Windows/Q_21337092.html

"I see, sorry I thought the rat file stored them. Looks like they are stored

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\4
etc...
An approved site has
PRPPolicyAttribute REG_DWORD 0x00000002 (2)
A non approved site has
PRPPolicyAttribute REG_DWORD 0x00000001 (1)

registry files are pretty easy to import using a logon script too."

******************************************
"richrumble:
The first entry is
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\0
the second is
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\1
etc...
you could one of two things.
1) Delete all the previous registry entries- (not recommended) then copy all the entries back in new and "old"
2) Add the new key's to the reg.

if your pretty confident that all the users have the key's you want right now... I'd just add the new entries.
You can use regedit to save the .reg files and have a batch script install them (store the reg-files on the logon share of your PDC (they will replicate to your BDC on their own))
You may want to put regedit.exe on the logon share also.
AS ALWAYS TEST TEST TEST- then TEST AGAIN, as the registry is a very fragile thing

regedit.exe /s blocked-sites.reg will put the following blocked-sites.reg data in the registry

blocked-sites.reg (this would add 1234567890.com (approved) and 0987654321.com (denied) to a new/clean registry with content advisor turned on)

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default]
"NumSys"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0]
"dwFlags"=dword:00000000
"errLine"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy]
"PRNumPolicy"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\0]
"PRPPolicyAttribute"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\0\PRPPolicySub]
"PRNumURLExpressions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\0\PRPPolicySub\0]
"PRBUInternetPattern"=dword:00000001
"PRBUNonWild"=dword:0000000c
"PRBUSpecified"=dword:0000001f
"PRBUHost"="1234567890.com"
"PRBUPort"="80"
"PRBUUrl"="1234567890.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\1]
"PRPPolicyAttribute"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\1\PRPPolicySub]
"PRNumURLExpressions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\1\PRPPolicySub\0]
"PRBUInternetPattern"=dword:00000001
"PRBUNonWild"=dword:0000000c
"PRBUSpecified"=dword:0000001f
"PRBUHost"="0987654321.com"
"PRBUPort"="80"
"PRBUUrl"="0987654321.com"

You will just want to append the entries...

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\0]
"PRPPolicyAttribute"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\0\PRPPolicySub]
"PRNumURLExpressions"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default\0\PRPolicy\0\PRPPolicySub\0]
"PRBUInternetPattern"=dword:00000001
"PRBUNonWild"=dword:0000000c
"PRBUSpecified"=dword:0000001f
"PRBUHost"="1234567890.com"
"PRBUPort"="80"
"PRBUUrl"="1234567890.com"

you'll have to fool with it a bit more than this I'll bet but that's the quick and dirty.
-rich"