Remove-GPRegistryValue

The Remove-GPRegistryValue cmdlet removes one or more registry-based policy settings from either Computer Configuration or User Configuration in a Group Policy Object (GPO). You can specify the GPO by its display name or by its GUID.

You can specify either a key or a value:

• If you specify a key, registry-based policy settings that configure any of its first-level values are removed. However, if there are registry-based policy settings that configure any subkeys or their values, an error occurs and no policy settings are removed, including those for first-level values of the key. For a key, specify the Key parameter without the ValueName parameter.

• If you specify a value, the registry-based policy setting that configures that registry value is removed. For a value, specify the Key parameter without the ValueName parameter.

This cmdlet can take input from the pipeline:

• You can pipe GPO objects to this cmdlet to remove a specified registry-based policy setting from one or more GPOs.

• You can pipe PolicyRegistrySetting objects to this cmdlet to remove one or more registry-based policy settings from a specified GPO.

$params = @{
    Name      = 'TestGPO'
    Key       = 'HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop'
    ValueName = 'ScreenSaveTimeOut'
}
Remove-GPRegistryValue @params

DisplayName      : TestGPO
DomainName       : contoso.com
Owner            : CONTOSO\Domain Admins
Id               : 35c12ab3-956c-45d5-973b-46b17d225f47
GpoStatus        : AllSettingsEnabled
Description      :
CreationTime     : 2/24/2009 4:41:03 PM
ModificationTime : 2/25/2009 12:45:52 PM
UserVersion      : AD Version: 4, SysVol Version: 4
ComputerVersion  : AD Version: 34, SysVol Version: 34
WmiFilter        :

This command removes the registry-based policy setting for the registry value HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop ScreenSaveTimeout from the GPO named TestGPO. The registry value is no longer modified when the GPO is applied on a client. Removing a policy setting does not delete the registry value on a client. To delete the registry value when the GPO is applied on a client, you must disable the policy setting by using the Set-GPRegistryValue cmdlet.

Remove-GPRegistryValue -Name "TestGPO" -Key "HKCU\Software\Policies\Microsoft\ExampleKey"

This command removes all the registry-based policy settings that configure first-level registry values under the key HKEY_CURRENT_USER\Software\Policies\Microsoft\ExampleKey from User Configuration in the GPO named TestGPO. If there are registry-based policy settings in User Configuration that configure registry values for any subkeys of this key, an error occurs and no first-level policy settings are removed.

Microsoft.GroupPolicy.Gpo

Microsoft.GroupPolicy.PolicyRegistrySetting

You can pipe a GPO from which to remove a registry-based policy setting, or a PolicyRegistrySetting object that represents a registry-based policy setting. Collections that contain GPOs from different domains are not supported.

Microsoft.GroupPolicy.Gpo

This cmdlet returns the GPO from which the registry-based policy setting (or settings) has been removed.

• The hive of the registry key that you specify -- HKEY_LOCAL_MACHINE (HKLM) or HKEY_CURRENT_USER (HKCU) indicates whether the registry-based policy setting is removed from Computer Configuration or User Configuration.

  If a value for the registry key cannot be located (the registry key is not configured) or if subkeys are present, an error occurs and a corresponding error message is displayed.

  You can use the Domain parameter to explicitly specify the ___domain for this cmdlet.

  If you do not explicitly specify the ___domain, the cmdlet uses a default ___domain. The default ___domain is the ___domain that is used to access network resources by the security context under which the current session is running. This ___domain is typically the ___domain of the user that is running the session. For instance, the ___domain of the user who started the session by opening Windows PowerShell from the Program Files menu, or the ___domain of a user that is specified in a runas command. However, computer startup and shutdown scripts run under the context of the LocalSystem account. The LocalSystem account is a built-in local account, and it accesses network resources under the context of the computer account. Therefore, when this cmdlet is run from a startup or shutdown script, the default ___domain is the ___domain to which the computer is joined.