How to Manage Registry Keys with Microsoft Intune for GPO Migration

Start by signing into the Microsoft Intune admin center to verify your access and permissions. This is your central hub for all registry management operations.

# Open your web browser and navigate to:
https://intune.microsoft.com

Sign in with your Global Admin or Intune Admin credentials. Once logged in, navigate to Devices > Scripts and remediations to confirm you have access to the scripting features.

Before creating or modifying registry keys, you need a detection script that checks if the desired registry configuration exists. This script determines whether remediation is needed.

Create a new PowerShell file named detect-registry.ps1 with the following content:

# Detection script for Adobe Acrobat DC registry settings
# This checks if the required registry path and values exist

try {
    # Check if the registry path exists
    $registryPath = "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cIPM"
    
    if (Test-Path $registryPath) {
        # Check if specific registry values exist with correct settings
        $value1 = Get-ItemProperty -Path $registryPath -Name "bDontShowMsgWhenViewingDoc" -ErrorAction SilentlyContinue
        $value2 = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" -Name "bIsSCReducedModeEnforcedEx" -ErrorAction SilentlyContinue
        
        if ($value1.bDontShowMsgWhenViewingDoc -eq 0 -and $value2.bIsSCReducedModeEnforcedEx -eq 1) {
            Write-Output "Registry configuration is compliant"
            exit 0  # Compliant - no remediation needed
        }
    }
    
    Write-Output "Registry configuration needs remediation"
    exit 1  # Non-compliant - remediation required
}
catch {
    Write-Output "Error checking registry: $($_.Exception.Message)"
    exit 1  # Error - trigger remediation
}

The remediation script creates or modifies registry keys when the detection script finds non-compliance. This script runs with elevated privileges to make the necessary changes.

Create remediate-registry.ps1 with the following content:

# Remediation script for Adobe Acrobat DC registry settings
# This creates the required registry keys and values

try {
    # Create the registry path if it doesn't exist
    $registryPath = "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cIPM"
    
    if (-not (Test-Path $registryPath)) {
        New-Item -Path $registryPath -Force | Out-Null
        Write-Output "Created registry path: $registryPath"
    }
    
    # Set the registry values
    New-ItemProperty -LiteralPath $registryPath -Name "bDontShowMsgWhenViewingDoc" -Value 0 -PropertyType DWord -Force | Out-Null
    Write-Output "Set bDontShowMsgWhenViewingDoc = 0"
    
    New-ItemProperty -LiteralPath "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" -Name "bIsSCReducedModeEnforcedEx" -Value 1 -PropertyType DWord -Force | Out-Null
    Write-Output "Set bIsSCReducedModeEnforcedEx = 1"
    
    Write-Output "Registry remediation completed successfully"
    exit 0  # Success
}
catch {
    Write-Output "Error during remediation: $($_.Exception.Message)"
    exit 1  # Failure
}

For HKCU registry keys, modify the script to use HKCU:\ paths instead:

# Example for HKCU registry modification
$registryPath = "HKCU:\SOFTWARE\MyCompany\Settings"
New-Item -Path $registryPath -Force | Out-Null
New-ItemProperty -LiteralPath $registryPath -Name "UserPreference" -Value "Enabled" -PropertyType String -Force | Out-Null

Proactive Remediations is the recommended method for ongoing registry key management. This creates a monitoring and enforcement mechanism that runs on a schedule.

In the Intune admin center, navigate to Devices > Scripts and remediations > Platform scripts and click Create, then select Windows 10 and later.

Configure the following settings:

• Name: "Adobe Acrobat DC Registry Configuration"
• Description: "Manages Adobe Acrobat DC security settings via registry keys"

In the Script settings section:

• Detection script file: Upload your detect-registry.ps1
• Remediation script file: Upload your remediate-registry.ps1
• Run this script using the logged on credentials: No (for HKLM keys)
• Enforce script signature check: No
• Run script in 64-bit PowerShell Host: Yes

Configure the schedule:

• Run frequency: Daily
• Start time: 02:00 AM (outside business hours)

Target your registry management to specific device groups to control which machines receive the configuration. This allows for phased rollouts and testing.

In your Proactive Remediation configuration, click on the Assignments tab. Configure the following:

Include groups:

• Click Add group
• Search for and select your target device group (e.g., "IT-Managed Workstations")
• Set Assignment type to "Required"

Exclude groups: Add any groups that should be excluded from this policy (e.g., "Test Devices" during production deployment).

# PowerShell command to verify group membership (run on target device)
Get-WmiObject -Class Win32_ComputerSystem | Select-Object Name, Domain

# Check if device is Azure AD joined
dsregcmd /status | findstr "AzureAdJoined"

Click Review + create to finalize the assignment.

For registry keys that need to be set during application installation, use the Win32 application method. This is ideal for software-specific registry settings.

First, download the Microsoft Win32 Content Prep Tool v1.11.4 from:

https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool/releases

Create a folder structure for your Win32 app:

mkdir C:\IntuneApps\RegistryConfig
cd C:\IntuneApps\RegistryConfig

Create an install.ps1 script:

# install.ps1 - Registry configuration during app deployment
Start-Transcript -Path "C:\Windows\Temp\RegistryConfig-Install.log"

try {
    # Create application-specific registry keys
    $appRegPath = "HKLM:\SOFTWARE\MyCompany\ApplicationSettings"
    New-Item -Path $appRegPath -Force | Out-Null
    
    # Set configuration values
    New-ItemProperty -Path $appRegPath -Name "ConfigVersion" -Value "2.1" -PropertyType String -Force
    New-ItemProperty -Path $appRegPath -Name "AutoUpdate" -Value 1 -PropertyType DWord -Force
    New-ItemProperty -Path $appRegPath -Name "TelemetryEnabled" -Value 0 -PropertyType DWord -Force
    
    Write-Output "Registry configuration completed successfully"
    exit 0
}
catch {
    Write-Error "Failed to configure registry: $($_.Exception.Message)"
    exit 1
}
finally {
    Stop-Transcript
}

Create the .intunewin package:

IntuneWinAppUtil.exe -c "C:\IntuneApps\RegistryConfig" -s "install.ps1" -o "C:\IntuneApps\Output"

Upload and configure your Win32 application in Intune to deploy registry settings alongside application installations.

In Intune admin center, navigate to Apps > Windows > Add and select Windows app (Win32).

Configure the app package information:

• Select app package file: Upload your .intunewin file
• Name: "Registry Configuration Package"
• Description: "Configures application-specific registry settings"
• Publisher: Your organization name

Set the program configuration:

• Install command: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File install.ps1
• Uninstall command: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Remove-Item 'HKLM:\SOFTWARE\MyCompany\ApplicationSettings' -Recurse -Force"
• Install behavior: System
• Device restart behavior: No specific action

Configure detection rules:

• Rules format: Manually configure detection rules
• Rule type: Registry
• Key path: HKLM\SOFTWARE\MyCompany\ApplicationSettings
• Value name: ConfigVersion
• Detection method: String comparison
• Operator: Equals
• Value: 2.1

Establish monitoring and troubleshooting procedures to ensure your registry configurations are working correctly across your device fleet.

Monitor Proactive Remediations:

1. Navigate to Devices > Scripts and remediations > Platform scripts
2. Select your registry configuration script
3. Review the Device status tab for compliance information

Create a custom compliance policy for additional monitoring:

# Custom compliance detection script
$registryPath = "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cIPM"
$complianceData = @{
    "RegistryPathExists" = (Test-Path $registryPath)
    "ConfigurationApplied" = $false
}

if ($complianceData.RegistryPathExists) {
    $value = Get-ItemProperty -Path $registryPath -Name "bDontShowMsgWhenViewingDoc" -ErrorAction SilentlyContinue
    $complianceData.ConfigurationApplied = ($value.bDontShowMsgWhenViewingDoc -eq 0)
}

# Output compliance data in JSON format
$complianceData | ConvertTo-Json

Common troubleshooting steps:

• Script execution errors: Check device logs in C:\Windows\Temp for PowerShell transcripts
• Permission issues: Verify script execution context (System vs User) matches registry hive requirements
• Detection failures: Test detection scripts locally with powershell.exe -ExecutionPolicy Bypass -File detect-registry.ps1

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cIPM" | Format-List