windows-xp/Source/XPSP1/NT/ds/security/gina/userenv/policy/gpreg.cpp

//*************************************************************
//
//  Group Policy Support for registry policies
//
//  Microsoft Confidential
//  Copyright (c) Microsoft Corporation 1997-1998
//  All rights reserved
//
//*************************************************************

#include "gphdr.h"


//*************************************************************
//
//  DeleteRegistryValue()
//
//  Purpose:    Callback from ParseRegistryFile that deletes
//              registry policies
//
//  Parameters: lpGPOInfo   -  GPO Information
//              lpKeyName   -  Key name
//              lpValueName -  Value name
//              dwType      -  Registry data type
//              lpData      -  Registry data
//              pwszGPO     -   Gpo
//              pwszSOM     -   Sdou that the Gpo is linked to
//              pHashTable  -   Hash table for registry keys
//
//  Return:     TRUE if successful
//              FALSE if an error occurs
//
//*************************************************************

BOOL DeleteRegistryValue (LPGPOINFO lpGPOInfo, LPTSTR lpKeyName,
                          LPTSTR lpValueName, DWORD dwType,
                          DWORD dwDataLength, LPBYTE lpData,
                          WCHAR *pwszGPO,
                          WCHAR *pwszSOM, REGHASHTABLE *pHashTable)
{
    DWORD dwDisp;
    HKEY hSubKey;
    LONG lResult;
    INT iStrLen;
    TCHAR szPolicies1[] = TEXT("Software\\Policies");
    TCHAR szPolicies2[] = TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Policies");
    XLastError xe;


    //
    // Check if there is a keyname
    //

    if (!lpKeyName || !(*lpKeyName)) {
        return TRUE;
    }


    //
    // Check if the key is in one of the policies keys
    //

    iStrLen = lstrlen(szPolicies1);
    if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE, szPolicies1,
                       iStrLen, lpKeyName, iStrLen) != CSTR_EQUAL) {

        iStrLen = lstrlen(szPolicies2);
        if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE, szPolicies2,
                           iStrLen, lpKeyName, iStrLen) != CSTR_EQUAL) {
            return TRUE;
        }
    }


    //
    // Check if the value name starts with **
    //

    if (lpValueName && (lstrlen(lpValueName) > 1)) {

        if ( (*lpValueName == TEXT('*')) && (*(lpValueName+1) == TEXT('*')) ) {
            return TRUE;
        }
    }


    //
    // We found a value that needs to be deleted
    //

    if (RegCleanUpValue (lpGPOInfo->hKeyRoot, lpKeyName, lpValueName)) {
        DebugMsg((DM_VERBOSE, TEXT("DeleteRegistryValue: Deleted %s\\%s"),
                 lpKeyName, lpValueName));
    } else {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("DeleteRegistryValue: Failed to delete %s\\%s"),
                 lpKeyName, lpValueName));
        return FALSE;
    }


    return TRUE;
}


//*************************************************************
//
//  ResetPolicies()
//
//  Purpose:    Resets the Policies and old Policies key to their
//              original state.
//
//  Parameters: lpGPOInfo   -   GPT information
//              lpArchive   -   Name of archive file
//
//
//  Return:     TRUE if successful
//              FALSE if an error occurs
//
//*************************************************************

BOOL ResetPolicies (LPGPOINFO lpGPOInfo, LPTSTR lpArchive)
{
    HKEY hKey;
    LONG lResult;
    DWORD dwDisp, dwValue = 0x91;
    XLastError xe;


    DebugMsg((DM_VERBOSE, TEXT("ResetPolicies: Entering.")));


    //
    // Parse the archive file and delete any policies
    //

    if (!ParseRegistryFile (lpGPOInfo, lpArchive,
                            DeleteRegistryValue, NULL, NULL, NULL, NULL, FALSE  )) {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ResetPolicies: Leaving")));
        return FALSE;
    }


    //
    // Recreate the new policies key
    //

    lResult = RegCreateKeyEx (lpGPOInfo->hKeyRoot,
                              TEXT("Software\\Policies"),
                              0, NULL, REG_OPTION_NON_VOLATILE,
                              KEY_WRITE, NULL, &hKey, &dwDisp);

    if (lResult == ERROR_SUCCESS) {

        //
        // Re-apply security
        //

        RegCloseKey (hKey);

        if (!MakeRegKeySecure((lpGPOInfo->dwFlags & GP_MACHINE) ? NULL : lpGPOInfo->hToken,
                              lpGPOInfo->hKeyRoot,
                              TEXT("Software\\Policies"))) {
            DebugMsg((DM_WARNING, TEXT("ResetPolicies: Failed to secure reg key.")));
        }

    } else {
        DebugMsg((DM_WARNING, TEXT("ResetPolicies: Failed to create reg key with %d."), lResult));
    }


    //
    // Recreate the old policies key
    //

    lResult = RegCreateKeyEx (lpGPOInfo->hKeyRoot,
                              TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Policies"),
                              0, NULL, REG_OPTION_NON_VOLATILE,
                              KEY_WRITE, NULL, &hKey, &dwDisp);

    if (lResult == ERROR_SUCCESS) {

        //
        // Re-apply security
        //

        RegCloseKey (hKey);

        if (!MakeRegKeySecure((lpGPOInfo->dwFlags & GP_MACHINE) ? NULL : lpGPOInfo->hToken,
                              lpGPOInfo->hKeyRoot,
                              TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Policies"))) {
            DebugMsg((DM_WARNING, TEXT("ResetPolicies: Failed to secure reg key.")));
        }

    } else {
        DebugMsg((DM_WARNING, TEXT("ResetPolicies: Failed to create reg key with %d."), lResult));
    }


    //
    // If this is user policy, reset the NoDriveTypeAutoRun default value
    //

    if (!(lpGPOInfo->dwFlags & GP_MACHINE)) {


        if (RegCreateKeyEx (lpGPOInfo->hKeyRoot,
                          TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"),
                          0, NULL, REG_OPTION_NON_VOLATILE,
                          KEY_WRITE, NULL, &hKey, &dwDisp) == ERROR_SUCCESS) {

            RegSetValueEx (hKey, TEXT("NoDriveTypeAutoRun"), 0,
                           REG_DWORD, (LPBYTE) &dwValue, sizeof(dwValue));

            RegCloseKey (hKey);
        }
    }

    DebugMsg((DM_VERBOSE, TEXT("ResetPolicies: Leaving.")));

    return TRUE;
}




//*************************************************************
//
//  ArchiveRegistryValue()
//
//  Purpose:    Archives a registry value in the specified file
//
//  Parameters: hFile - File handle of archive file
//              lpKeyName    -  Key name
//              lpValueName  -  Value name
//              dwType       -  Registry value type
//              dwDataLength -  Registry value size
//              lpData       -  Registry value
//
//  Return:     TRUE if successful
//              FALSE if an error occurs
//
//*************************************************************

BOOL ArchiveRegistryValue(HANDLE hFile, LPWSTR lpKeyName,
                          LPWSTR lpValueName, DWORD dwType,
                          DWORD dwDataLength, LPBYTE lpData)
{
    BOOL bResult = FALSE;
    DWORD dwBytesWritten;
    DWORD dwTemp;
    const WCHAR cOpenBracket = L'[';
    const WCHAR cCloseBracket = L']';
    const WCHAR cSemiColon = L';';
    XLastError xe;


    //
    // Write the entry to the text file.
    //
    // Format:
    //
    // [keyname;valuename;type;datalength;data]
    //

    // open bracket
    if (!WriteFile (hFile, &cOpenBracket, sizeof(WCHAR), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(WCHAR))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write open bracket with %d"),
                 GetLastError()));
        goto Exit;
    }


    // key name
    dwTemp = (lstrlen (lpKeyName) + 1) * sizeof (WCHAR);
    if (!WriteFile (hFile, lpKeyName, dwTemp, &dwBytesWritten, NULL) ||
        dwBytesWritten != dwTemp)
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write key name with %d"),
                 GetLastError()));
        goto Exit;
    }


    // semicolon
    if (!WriteFile (hFile, &cSemiColon, sizeof(WCHAR), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(WCHAR))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write semicolon with %d"),
                 GetLastError()));
        goto Exit;
    }

    // value name
    dwTemp = (lstrlen (lpValueName) + 1) * sizeof (WCHAR);
    if (!WriteFile (hFile, lpValueName, dwTemp, &dwBytesWritten, NULL) ||
        dwBytesWritten != dwTemp)
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write value name with %d"),
                 GetLastError()));
        goto Exit;
    }


    // semicolon
    if (!WriteFile (hFile, &cSemiColon, sizeof(WCHAR), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(WCHAR))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write semicolon with %d"),
                 GetLastError()));
        goto Exit;
    }

    // type
    if (!WriteFile (hFile, &dwType, sizeof(DWORD), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(DWORD))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write data type with %d"),
                 GetLastError()));
        goto Exit;
    }

    // semicolon
    if (!WriteFile (hFile, &cSemiColon, sizeof(WCHAR), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(WCHAR))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write semicolon with %d"),
                 GetLastError()));
        goto Exit;
    }

    // data length
    if (!WriteFile (hFile, &dwDataLength, sizeof(DWORD), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(DWORD))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write data type with %d"),
                 GetLastError()));
        goto Exit;
    }

    // semicolon
    if (!WriteFile (hFile, &cSemiColon, sizeof(WCHAR), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(WCHAR))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write semicolon with %d"),
                 GetLastError()));
        goto Exit;
    }

    // data
    if (!WriteFile (hFile, lpData, dwDataLength, &dwBytesWritten, NULL) ||
        dwBytesWritten != dwDataLength)
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write data with %d"),
                 GetLastError()));
        goto Exit;
    }

    // close bracket
    if (!WriteFile (hFile, &cCloseBracket, sizeof(WCHAR), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(WCHAR))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ArchiveRegistryValue: Failed to write close bracket with %d"),
                 GetLastError()));
        goto Exit;
    }


    //
    // Sucess
    //

    bResult = TRUE;

Exit:

    return bResult;
}


//*************************************************************
//
//  ParseRegistryFile()
//
//  Purpose:    Parses a registry.pol file
//
//  Parameters: lpGPOInfo          -   GPO information
//              lpRegistry         -   Path to registry.pol
//              pfnRegFileCallback -   Callback function
//              hArchive           -   Handle to archive file
//              pwszGPO            -   Gpo
//              pwszSOM            -   Sdou that the Gpo is linked to
//              pHashTable         -   Hash table for registry keys
//
//
//  Return:     TRUE if successful
//              FALSE if an error occurs
//
//*************************************************************

BOOL ParseRegistryFile (LPGPOINFO lpGPOInfo, LPTSTR lpRegistry,
                        PFNREGFILECALLBACK pfnRegFileCallback,
                        HANDLE hArchive, WCHAR *pwszGPO,
                        WCHAR *pwszSOM, REGHASHTABLE *pHashTable,
                        BOOL bRsopPlanningMode)
{
    HANDLE hFile = INVALID_HANDLE_VALUE;
    BOOL bResult = FALSE;
    DWORD dwTemp, dwBytesRead, dwType, dwDataLength;
    LPWSTR lpKeyName = 0, lpValueName = 0, lpTemp;
    LPBYTE lpData = NULL;
    WCHAR  chTemp;
    HANDLE hOldToken;
    XLastError xe;


    //
    // Verbose output
    //

    DebugMsg((DM_VERBOSE, TEXT("ParseRegistryFile: Entering with <%s>."),
             lpRegistry));


    //
    // Open the registry file
    //

    if(!bRsopPlanningMode) {
        if (!ImpersonateUser(lpGPOInfo->hToken, &hOldToken)) {
            xe = GetLastError();
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to impersonate user")));
            goto Exit;
        }
    }

    hFile = CreateFile (lpRegistry, GENERIC_READ, FILE_SHARE_READ, NULL,
                        OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_SEQUENTIAL_SCAN,
                        NULL);

    if(!bRsopPlanningMode) {
        RevertToUser(&hOldToken);
    }

    if (hFile == INVALID_HANDLE_VALUE) {
        if ((GetLastError() == ERROR_FILE_NOT_FOUND) ||
            (GetLastError() == ERROR_PATH_NOT_FOUND))
        {
            bResult = TRUE;
            goto Exit;
        }
        else
        {
            xe = GetLastError();
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: CreateFile failed with %d"),
                     GetLastError()));
            CEvents ev(TRUE, EVENT_NO_REGISTRY);
            ev.AddArg(lpRegistry); ev.AddArgWin32Error(GetLastError()); ev.Report();
            goto Exit;
        }
    }


    //
    // Allocate buffers to hold the keyname, valuename, and data
    //

    lpKeyName = (LPWSTR) LocalAlloc (LPTR, MAX_KEYNAME_SIZE * sizeof(WCHAR));

    if (!lpKeyName)
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to allocate memory with %d"),
                 GetLastError()));
        goto Exit;
    }


    lpValueName = (LPWSTR) LocalAlloc (LPTR, MAX_VALUENAME_SIZE * sizeof(WCHAR));

    if (!lpValueName)
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to allocate memory with %d"),
                 GetLastError()));
        goto Exit;
    }


    //
    // Read the header block
    //
    // 2 DWORDS, signature (PReg) and version number and 2 newlines
    //

    if (!ReadFile (hFile, &dwTemp, sizeof(dwTemp), &dwBytesRead, NULL) ||
        dwBytesRead != sizeof(dwTemp))
    {
        xe = ERROR_INVALID_DATA;
        DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read signature with %d"),
                 GetLastError()));
        goto Exit;
    }


    if (dwTemp != REGFILE_SIGNATURE)
    {
        xe = ERROR_INVALID_DATA;
        DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Invalid file signature")));
        goto Exit;
    }


    if (!ReadFile (hFile, &dwTemp, sizeof(dwTemp), &dwBytesRead, NULL) ||
        dwBytesRead != sizeof(dwTemp))
    {
        xe = ERROR_INVALID_DATA;
        DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read version number with %d"),
                 GetLastError()));
        goto Exit;
    }

    if (dwTemp != REGISTRY_FILE_VERSION)
    {
        xe = ERROR_INVALID_DATA;
        DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Invalid file version")));
        goto Exit;
    }


    //
    // Read the data
    //

    while (TRUE)
    {

        //
        // Read the first character.  It will either be a [ or the end
        // of the file.
        //

        if (!ReadFile (hFile, &chTemp, sizeof(WCHAR), &dwBytesRead, NULL))
        {
            if (GetLastError() != ERROR_HANDLE_EOF)
            {
                xe = ERROR_INVALID_DATA;
                DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read first character with %d"),
                         GetLastError()));
                goto Exit;
            }
            break;
        }

        if ((dwBytesRead == 0) || (chTemp != L'['))
        {
            break;
        }


        //
        // Read the keyname
        //

        lpTemp = lpKeyName;
        dwTemp = 0;

        while (dwTemp < MAX_KEYNAME_SIZE)
        {

            if (!ReadFile (hFile, &chTemp, sizeof(WCHAR), &dwBytesRead, NULL))
            {
                xe = ERROR_INVALID_DATA;
                DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read keyname character with %d"),
                         GetLastError()));
                goto Exit;
            }

            *lpTemp++ = chTemp;

            if (chTemp == TEXT('\0'))
                break;

            dwTemp++;
        }

        if (dwTemp >= MAX_KEYNAME_SIZE)
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Keyname exceeded max size")));
            goto Exit;
        }


        //
        // Read the semi-colon
        //

        if (!ReadFile (hFile, &chTemp, sizeof(WCHAR), &dwBytesRead, NULL))
        {
            if (GetLastError() != ERROR_HANDLE_EOF)
            {
                xe = ERROR_INVALID_DATA;
                DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read first character with %d"),
                         GetLastError()));
                goto Exit;
            }
            break;
        }

        if ((dwBytesRead == 0) || (chTemp != L';'))
        {
            break;
        }


        //
        // Read the valuename
        //

        lpTemp = lpValueName;
        dwTemp = 0;

        while (dwTemp < MAX_VALUENAME_SIZE)
        {

            if (!ReadFile (hFile, &chTemp, sizeof(WCHAR), &dwBytesRead, NULL))
            {
                xe = ERROR_INVALID_DATA;
                DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read valuename character with %d"),
                         GetLastError()));
                goto Exit;
            }

            *lpTemp++ = chTemp;

            if (chTemp == TEXT('\0'))
                break;

            dwTemp++;
        }

        if (dwTemp >= MAX_VALUENAME_SIZE)
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Valuename exceeded max size")));
            goto Exit;
        }


        //
        // Read the semi-colon
        //

        if (!ReadFile (hFile, &chTemp, sizeof(WCHAR), &dwBytesRead, NULL))
        {
            if (GetLastError() != ERROR_HANDLE_EOF)
            {
                xe = ERROR_INVALID_DATA;
                DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read first character with %d"),
                         GetLastError()));
                goto Exit;
            }
            break;
        }

        if ((dwBytesRead == 0) || (chTemp != L';'))
        {
            break;
        }


        //
        // Read the type
        //

        if (!ReadFile (hFile, &dwType, sizeof(DWORD), &dwBytesRead, NULL))
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read type with %d"),
                     GetLastError()));
            goto Exit;
        }


        //
        // Skip semicolon
        //

        if (!ReadFile (hFile, &dwTemp, sizeof(WCHAR), &dwBytesRead, NULL))
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to skip semicolon with %d"),
                     GetLastError()));
            goto Exit;
        }


        //
        // Read the data length
        //

        if (!ReadFile (hFile, &dwDataLength, sizeof(DWORD), &dwBytesRead, NULL))
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to data length with %d"),
                     GetLastError()));
            goto Exit;
        }


        //
        // Skip semicolon
        //

        if (!ReadFile (hFile, &dwTemp, sizeof(WCHAR), &dwBytesRead, NULL))
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to skip semicolon with %d"),
                     GetLastError()));
            goto Exit;
        }


        //
        // Allocate memory for data
        //

        lpData = (LPBYTE) LocalAlloc (LPTR, dwDataLength);

        if (!lpData)
        {
            xe = GetLastError();
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to allocate memory for data with %d"),
                     GetLastError()));
            goto Exit;
        }


        //
        // Read data
        //

        if (!ReadFile (hFile, lpData, dwDataLength, &dwBytesRead, NULL))
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to read data with %d"),
                     GetLastError()));
            goto Exit;
        }


        //
        // Skip closing bracket
        //

        if (!ReadFile (hFile, &chTemp, sizeof(WCHAR), &dwBytesRead, NULL))
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Failed to skip closing bracket with %d"),
                     GetLastError()));
            goto Exit;
        }

        if (chTemp != L']')
        {
            xe = ERROR_INVALID_DATA;
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Expected to find ], but found %c"),
                     chTemp));
            goto Exit;
        }


        //
        // Call the callback function
        //

        if (!pfnRegFileCallback (lpGPOInfo, lpKeyName, lpValueName,
                                 dwType, dwDataLength, lpData,
                                 pwszGPO, pwszSOM, pHashTable ))
        {
            xe = GetLastError();
            DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: Callback function returned false.")));
            goto Exit;
        }


        //
        // Archive the data if appropriate
        //

        if (hArchive) {
            if (!ArchiveRegistryValue(hArchive, lpKeyName, lpValueName,
                                      dwType, dwDataLength, lpData)) {
                DebugMsg((DM_WARNING, TEXT("ParseRegistryFile: ArchiveRegistryValue returned false.")));
            }
        }

        LocalFree (lpData);
        lpData = NULL;

    }

    bResult = TRUE;

Exit:

    //
    // Finished
    //

    if ( !bResult )
    {
        CEvents ev(TRUE, EVENT_REGISTRY_TEMPLATE_ERROR);
        ev.AddArg(lpRegistry ? lpRegistry : TEXT("")); ev.AddArgWin32Error( xe ); ev.Report();
    }

    DebugMsg((DM_VERBOSE, TEXT("ParseRegistryFile: Leaving.")));
    if (lpData) {
        LocalFree (lpData);
    }
    if ( hFile != INVALID_HANDLE_VALUE ) {
        CloseHandle (hFile);
    }
    if ( lpKeyName ) {
        LocalFree (lpKeyName);
    }
    if ( lpValueName ) {
        LocalFree (lpValueName);
    }

    return bResult;
}


//*************************************************************
//
//  ProcessRegistryValue()
//
//  Purpose: Callback passed to ParseRegistryFile from ProcessRegistryFiles. Invokes AddRegHashEntry
//                  with appropriate parameters depending on the registry policy settings.
//
//  Parameters:
//                          pUnused -    Not used. It si there only to conform to the signature
//                                              expected by ParseRegistryFile.
//                          lpKeyName - registry key name
//                          lpValueName - Registry value name
//                          dwType -    Registry value type
//                          dwDataLength - Length of registry value data.
//                          lpData - Regsitry value data
//                          *pwszGPO - GPO associated with this registry setting
//                          *pwszSOM - SOM associated with the GPO
//                          *pHashTable - Hash table containing registry policy data for a policy target.
//
//  Return:     TRUE if successful
//                  FALSE if an error occurs
//
//*************************************************************

BOOL ProcessRegistryValue (   void* pUnused,
                                    LPTSTR lpKeyName,
                                    LPTSTR lpValueName,
                                    DWORD dwType,
                                    DWORD dwDataLength,
                                    LPBYTE lpData,
                                    WCHAR *pwszGPO,
                                    WCHAR *pwszSOM,
                                    REGHASHTABLE *pHashTable)
{
    BOOL bLoggingOk = TRUE;

    //
    // Special case some values
    //

    if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**del."), 6, lpValueName, 6) == 2)
    {
        LPTSTR lpRealValueName = lpValueName + 6;


        //
        // Delete one specific value
        //

        bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEVALUE, lpKeyName,
                                      lpRealValueName, 0, 0, NULL,
                                      pwszGPO, pwszSOM, lpValueName, TRUE );
    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**delvals."), 10, lpValueName, 10) == 2)
    {

        //
        // Delete all values in the destination key
        //

        bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEALLVALUES, lpKeyName,
                                      NULL, 0, 0, NULL,
                                      pwszGPO, pwszSOM, lpValueName, TRUE );

    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**DeleteValues"), 14, lpValueName, 14) == 2)
    {
        TCHAR szValueName[MAX_PATH];
        LPTSTR lpName, lpNameTemp;

        lpName = (LPTSTR)lpData;

        while (*lpName) {

            lpNameTemp = szValueName;

            while (*lpName && *lpName == TEXT(' ')) {
                lpName++;
            }

            while (*lpName && *lpName != TEXT(';')) {
                *lpNameTemp++ = *lpName++;
            }

            *lpNameTemp= TEXT('\0');

            while (*lpName == TEXT(';')) {
                lpName++;
            }


            bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEVALUE, lpKeyName,
                                          szValueName, 0, 0, NULL,
                                          pwszGPO, pwszSOM, lpValueName, TRUE );
        }
    }

    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**DeleteKeys"), 12, lpValueName, 12) == 2)
    {
        TCHAR szKeyName[MAX_KEYNAME_SIZE];
        LPTSTR lpName, lpNameTemp, lpEnd;

        lpName = (LPTSTR)lpData;

        while (*lpName) {

            szKeyName[0] = TEXT('\0');
            lpNameTemp = szKeyName;

            while (*lpName && *lpName == TEXT(' ')) {
                lpName++;
            }

            while (*lpName && *lpName != TEXT(';')) {
                *lpNameTemp++ = *lpName++;
            }

            *lpNameTemp= TEXT('\0');

            while (*lpName == TEXT(';')) {
                lpName++;
            }

            bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEKEY, lpKeyName,
                                          NULL, 0, 0, NULL,
                                          pwszGPO, pwszSOM, lpValueName, TRUE );
        }
    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**soft."), 7, lpValueName, 7) == 2)
    {
        //
        // In planning mode we will assume the value does not exist in the target computer.
        // Therefore, we set it if no value exists in the hash table.
        //
        // Soft add is dealt with differently in planning mode vs. diag mode.
        // In diag mode, check is done while processing policy and it is logged as a add value
        // if the key doesn't exist.
        // In planning mode, key is not supposed to exist beforehand and the hash table itself is
        // used to determine whether to add the key or not.


        LPTSTR lpRealValueName = lpValueName + 7;

        bLoggingOk = AddRegHashEntry( pHashTable, REG_SOFTADDVALUE, lpKeyName,
                                      lpRealValueName, dwType, dwDataLength, lpData,
                                      pwszGPO, pwszSOM, lpValueName, TRUE );

    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**SecureKey"), 11, lpValueName, 11) == 2)
    {
        // There is nothing to do here.
    } else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**Comment:"), 10, lpValueName, 10) == 2)
    {
        //
        // Comment - can be ignored
        //
    }
    else
    {

        //
        // AddRegHashEntry needs to log a key being logged but no values.
        //

        bLoggingOk = AddRegHashEntry( pHashTable, REG_ADDVALUE, lpKeyName,
                                      lpValueName, dwType, dwDataLength, lpData,
                                      pwszGPO, pwszSOM, TEXT(""), TRUE );
    }

    return bLoggingOk;
}


//*************************************************************
//
//  ResetRegKeySecurity
//
//  Purpose:    Resets the security on a user's key
//
//  Parameters: hKeyRoot    -   Handle to the root of the hive
//              lpKeyName   -   Subkey name
//
//
//  Return:     TRUE if successful
//              FALSE if an error occurs
//
//*************************************************************

BOOL ResetRegKeySecurity (HKEY hKeyRoot, LPTSTR lpKeyName)
{
    PSECURITY_DESCRIPTOR pSD = NULL;
    DWORD dwSize = 0;
    LONG lResult;
    HKEY hSubKey;
    XLastError xe;


    RegGetKeySecurity(hKeyRoot, DACL_SECURITY_INFORMATION, pSD, &dwSize);

    if (!dwSize) {
       DebugMsg((DM_WARNING, TEXT("ResetRegKeySecurity: RegGetKeySecurity returned 0")));
       return FALSE;
    }

    pSD = LocalAlloc (LPTR, dwSize);

    if (!pSD) {
       xe = GetLastError();
       DebugMsg((DM_WARNING, TEXT("ResetRegKeySecurity: Failed to allocate memory")));
       return FALSE;
    }


    lResult = RegGetKeySecurity(hKeyRoot, DACL_SECURITY_INFORMATION, pSD, &dwSize);
    if (lResult != ERROR_SUCCESS) {
        xe = GetLastError();
       DebugMsg((DM_WARNING, TEXT("ResetRegKeySecurity: Failed to query key security with %d"),
                lResult));
       LocalFree (pSD);
       return FALSE;
    }


    lResult = RegOpenKeyEx(hKeyRoot,
                         lpKeyName,
                         0,
                         WRITE_DAC | KEY_ENUMERATE_SUB_KEYS | READ_CONTROL,
                         &hSubKey);

    if (lResult != ERROR_SUCCESS) {
       xe = GetLastError();
       DebugMsg((DM_WARNING, TEXT("ResetRegKeySecurity: Failed to open sub key with %d"),
                lResult));
       LocalFree (pSD);
       return FALSE;
    }

    lResult = RegSetKeySecurity (hSubKey, DACL_SECURITY_INFORMATION, pSD);

    RegCloseKey (hSubKey);
    LocalFree (pSD);

    if (lResult != ERROR_SUCCESS) {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ResetRegKeySecure: Failed to set security, error = %d"), lResult));
        return FALSE;
    }

    return TRUE;

}


//*************************************************************
//
//  SetRegistryValue()
//
//  Purpose:    Callback from ParseRegistryFile that sets
//              registry policies
//
//  Parameters: lpGPOInfo   -  GPO Information
//              lpKeyName   -  Key name
//              lpValueName -  Value name
//              dwType      -  Registry data type
//              lpData      -  Registry data
//              pwszGPO     -   Gpo
//              pwszSOM     -   Sdou that the Gpo is linked to
//              pHashTable  -   Hash table for registry keys
//
//  Return:     TRUE if successful
//              FALSE if an error occurs
//
//*************************************************************

BOOL SetRegistryValue (LPGPOINFO lpGPOInfo, LPTSTR lpKeyName,
                       LPTSTR lpValueName, DWORD dwType,
                       DWORD dwDataLength, LPBYTE lpData,
                       WCHAR *pwszGPO,
                       WCHAR *pwszSOM, REGHASHTABLE *pHashTable)
{
    DWORD dwDisp;
    HKEY hSubKey;
    LONG lResult;
    BOOL bLoggingOk = TRUE;
    BOOL bRsopLogging = (pHashTable != NULL);  // Is diagnostic mode Rsop logging enabled ?
    BOOL bUseValueName = FALSE;
    BOOL bRegOpSuccess =  TRUE;
    XLastError xe;
    
    //
    // Special case some values
    //
    if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**del."), 6, lpValueName, 6) == 2)
    {
        LPTSTR lpRealValueName = lpValueName + 6;

        //
        // Delete one specific value
        //

        lResult = RegOpenKeyEx (lpGPOInfo->hKeyRoot,
                        lpKeyName, 0, KEY_WRITE, &hSubKey);

        if (lResult == ERROR_SUCCESS)
        {
            lResult = RegDeleteValue(hSubKey, lpRealValueName);

            if ((lResult == ERROR_SUCCESS) || (lResult == ERROR_FILE_NOT_FOUND))
            {
                DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: Deleted value <%s>."),
                         lpRealValueName));
                if (lpGPOInfo->dwFlags & GP_VERBOSE) {
                    CEvents ev(FALSE, EVENT_DELETED_VALUE);
                    ev.AddArg(lpRealValueName); ev.Report();
                }

                if ( bRsopLogging ) {
                    bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEVALUE, lpKeyName,
                                                  lpRealValueName, 0, 0, NULL,
                                                  pwszGPO, pwszSOM, lpValueName, TRUE );
                    if (!bLoggingOk) {
                        DebugMsg((DM_WARNING, TEXT("SetRegistryValue: AddRegHashEntry failed for REG_DELETEVALUE <%s>."), lpRealValueName));
                        pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
                    }
                }
            }
            else
            {
                DebugMsg((DM_WARNING, TEXT("SetRegistryValue: Failed to delete value <%s> with %d"),
                         lpRealValueName, lResult));
                xe = lResult;
                CEvents ev(TRUE, EVENT_FAIL_DELETE_VALUE);
                ev.AddArg(lpRealValueName); ev.AddArgWin32Error(lResult); ev.Report();
                bRegOpSuccess = FALSE;
            }

            RegCloseKey (hSubKey);
        }
        else if (lResult == ERROR_FILE_NOT_FOUND) {
            
            //
            // Log into rsop even if the key is not found
            //

            if ( bRsopLogging ) {
                bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEVALUE, lpKeyName,
                                              lpRealValueName, 0, 0, NULL,
                                              pwszGPO, pwszSOM, lpValueName, TRUE );
                if (!bLoggingOk) {
                    pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
                    DebugMsg((DM_WARNING, TEXT("SetRegistryValue: AddRegHashEntry failed for REG_DELETEVALUE (notfound) <%s>."), lpRealValueName));
                }
            }
        }
    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**delvals."), 10, lpValueName, 10) == 2)
    {

        //
        // Delete all values in the destination key
        //
        lResult = RegOpenKeyEx (lpGPOInfo->hKeyRoot,
                        lpKeyName, 0, KEY_WRITE | KEY_READ, &hSubKey);

        if (lResult == ERROR_SUCCESS)
        {
            if (!bRsopLogging)
                bRegOpSuccess = DeleteAllValues(hSubKey);
            else
                bRegOpSuccess = RsopDeleteAllValues(hSubKey, pHashTable, lpKeyName,
                                              pwszGPO, pwszSOM, lpValueName, &bLoggingOk );

            DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: Deleted all values in <%s>."),
                     lpKeyName));
            RegCloseKey (hSubKey);

            if (!bRegOpSuccess) {
                xe = GetLastError();
            }

            DebugMsg((DM_WARNING, TEXT("SetRegistryValue: DeleteAllvalues finished for %s. bRegOpSuccess = %s, bLoggingOk = %s."), 
                      lpKeyName, (bRegOpSuccess ? TEXT("TRUE") : TEXT("FALSE")), (bLoggingOk ? TEXT("TRUE") : TEXT("FALSE"))));

        }
        else if (lResult == ERROR_FILE_NOT_FOUND) {
            
            //
            // Log into rsop even if the key is not found
            // as just deleteallvalues
            //

            if ( bRsopLogging ) {
                bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEALLVALUES, lpKeyName,
                              NULL, 0, 0, NULL,
                              pwszGPO, pwszSOM, lpValueName, TRUE );

                if (!bLoggingOk) {
                    DebugMsg((DM_WARNING, TEXT("SetRegistryValue: AddRegHashEntry failed for REG_DELETEALLVALUES (notfound) key - <%s>, value <%s>."), lpKeyName, lpValueName));
                }
            }
        }
    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**DeleteValues"), 14, lpValueName, 14) == 2)
    {
        TCHAR szValueName[MAX_PATH];
        LPTSTR lpName, lpNameTemp;
        LONG   lKeyResult;

        //
        // Delete the values  (semi-colon separated)
        //

        lKeyResult = RegOpenKeyEx (lpGPOInfo->hKeyRoot,
                        lpKeyName, 0, KEY_WRITE, &hSubKey);

        lpName = (LPTSTR)lpData;

        while (*lpName) {

            lpNameTemp = szValueName;

            while (*lpName && *lpName == TEXT(' ')) {
                lpName++;
            }

            while (*lpName && *lpName != TEXT(';')) {
                *lpNameTemp++ = *lpName++;
            }

            *lpNameTemp= TEXT('\0');

            while (*lpName == TEXT(';')) {
                lpName++;
            }


            if (lKeyResult == ERROR_SUCCESS)
            {
                lResult = RegDeleteValue (hSubKey, szValueName);

                if ((lResult == ERROR_SUCCESS) || (lResult == ERROR_FILE_NOT_FOUND))
                {
                    DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: Deleted value <%s>."),
                             szValueName));
                    if (lpGPOInfo->dwFlags & GP_VERBOSE) {
                        CEvents ev(FALSE, EVENT_DELETED_VALUE);
                        ev.AddArg(szValueName); ev.Report();
                    }
                    
                    if ( bRsopLogging ) {
                        bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEVALUE, lpKeyName,
                                                      szValueName, 0, 0, NULL,
                                                      pwszGPO, pwszSOM, lpValueName, TRUE );

                        if (!bLoggingOk) {
                            DebugMsg((DM_WARNING, TEXT("SetRegistryValue: AddRegHashEntry failed for REG_DELETEVALUE value <%s>."), szValueName));
                            pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
                        }
                    }
                }
                else
                {
                    DebugMsg((DM_WARNING, TEXT("SetRegistryValue: Failed to delete value <%s> with %d"),
                             szValueName, lResult));
                    CEvents ev(TRUE, EVENT_FAIL_DELETE_VALUE);
                    ev.AddArg(szValueName); ev.AddArgWin32Error(lResult); ev.Report();
                    xe = lResult;
                    bRegOpSuccess = FALSE;
                }
            }
            else if (lKeyResult == ERROR_FILE_NOT_FOUND) {
                if ( bRsopLogging ) {
                    bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEVALUE, lpKeyName,
                                                  szValueName, 0, 0, NULL,
                                                  pwszGPO, pwszSOM, lpValueName, TRUE );

                    if (!bLoggingOk) {
                        DebugMsg((DM_WARNING, TEXT("SetRegistryValue: AddRegHashEntry failed for REG_DELETEVALUE value (not found case) <%s>."), szValueName));
                        pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
                    }
                }
            }
        }


        if (lKeyResult == ERROR_SUCCESS)
        {
            RegCloseKey (hSubKey);
        }
    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**DeleteKeys"), 12, lpValueName, 12) == 2)
    {
        TCHAR szKeyName[MAX_KEYNAME_SIZE];
        LPTSTR lpName, lpNameTemp, lpEnd;

        //
        // Delete keys
        //

        lpName = (LPTSTR)lpData;

        while (*lpName) {

            szKeyName[0] = TEXT('\0');
            lpNameTemp = szKeyName;

            while (*lpName && *lpName == TEXT(' ')) {
                lpName++;
            }

            while (*lpName && *lpName != TEXT(';')) {
                *lpNameTemp++ = *lpName++;
            }

            *lpNameTemp= TEXT('\0');

            while (*lpName == TEXT(';')) {
                lpName++;
            }


            if (RegDelnode (lpGPOInfo->hKeyRoot,
                        szKeyName))
            {
                DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: Deleted key <%s>."),
                         szKeyName));
                if (lpGPOInfo->dwFlags & GP_VERBOSE) {
                    CEvents ev(FALSE, EVENT_DELETED_KEY);
                    ev.AddArg(szKeyName); ev.Report();
                }
            }
            else
            {
                xe = GetLastError();
                bRegOpSuccess = FALSE;
                DebugMsg((DM_WARNING, TEXT("SetRegistryValue: RegDelnode for key <%s>."), szKeyName));
            }

            if ( bRsopLogging ) {
                bLoggingOk = AddRegHashEntry( pHashTable, REG_DELETEKEY, szKeyName,
                                              NULL, 0, 0, NULL,
                                              pwszGPO, pwszSOM, lpValueName, TRUE );
                if (!bLoggingOk) { 
                    DebugMsg((DM_WARNING, TEXT("SetRegistryValue: AddRegHashEntry failed for REG_DELETEKEY  <%s>."), szKeyName));
                    pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
                }
            }

        }

    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**soft."), 7, lpValueName, 7) == 2)
    {

        //
        // "soft" value, only set this if it doesn't already
        // exist in destination
        //

        lResult = RegOpenKeyEx (lpGPOInfo->hKeyRoot,
                        lpKeyName, 0, KEY_QUERY_VALUE, &hSubKey);

        if (lResult == ERROR_SUCCESS)
        {
            TCHAR TmpValueData[MAX_PATH+1];
            DWORD dwSize=sizeof(TmpValueData);

            lResult = RegQueryValueEx(hSubKey, lpValueName + 7,
                                      NULL,NULL,(LPBYTE) TmpValueData,
                                      &dwSize);

            RegCloseKey (hSubKey);

            if (lResult != ERROR_SUCCESS)
            {
                lpValueName += 7;
                bUseValueName = TRUE;
                goto SetValue;
            }
        }
    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**SecureKey"), 11, lpValueName, 11) == 2)
    {
        //
        // Secure / unsecure a key (user only)
        //
        if (!(lpGPOInfo->dwFlags & GP_MACHINE))
        {
            if (*((LPDWORD)lpData) == 1)
            {
                DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: Securing key <%s>."),
                         lpKeyName));
                bRegOpSuccess = MakeRegKeySecure(lpGPOInfo->hToken, lpGPOInfo->hKeyRoot, lpKeyName);
            }
            else
            {

                DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: Unsecuring key <%s>."),
                         lpKeyName));

                bRegOpSuccess = ResetRegKeySecurity (lpGPOInfo->hKeyRoot, lpKeyName);
            }

            if (!bRegOpSuccess) {
                xe = GetLastError();
            }
        }
    }
    else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                       TEXT("**Comment:"), 10, lpValueName, 10) == 2)
    {
        //
        // Comment - can be ignored
        //

        DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: Found comment %s."),
                 (lpValueName+10)));
    }
    else
    {
SetValue:
        //
        // Save registry value
        //

        lResult = RegCreateKeyEx (lpGPOInfo->hKeyRoot,
                        lpKeyName, 0, NULL, REG_OPTION_NON_VOLATILE,
                        KEY_WRITE, NULL, &hSubKey, &dwDisp);

        if (lResult == ERROR_SUCCESS)
        {

            if ((dwType == REG_NONE) && (dwDataLength == 0) &&
                (*lpValueName == L'\0'))
            {
                lResult = ERROR_SUCCESS;
            }
            else
            {
                lResult = RegSetValueEx (hSubKey, lpValueName, 0, dwType,
                                         lpData, dwDataLength);
            }

            if ( bRsopLogging ) {
                bLoggingOk = AddRegHashEntry( pHashTable, REG_ADDVALUE, lpKeyName,
                                              lpValueName, dwType, dwDataLength, lpData,
                                              pwszGPO, pwszSOM, bUseValueName ? lpValueName : TEXT(""), TRUE );
                if (!bLoggingOk) {
                    DebugMsg((DM_WARNING, TEXT("SetRegistryValue: AddRegHashEntry failed for REG_ADDVALUE key <%s>, value <%s>."), lpKeyName, lpValueName));
                    pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
                }
            }


            RegCloseKey (hSubKey);

            if (lResult == ERROR_SUCCESS)
            {
                switch (dwType) {
                    case REG_SZ:
                    case REG_EXPAND_SZ:
                        DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: %s => %s  [OK]"),
                                 lpValueName, (LPTSTR)lpData));
                        if (lpGPOInfo->dwFlags & GP_VERBOSE) {
                            CEvents ev(FALSE, EVENT_SET_STRING_VALUE);
                            ev.AddArg(lpValueName); ev.AddArg((LPTSTR)lpData); ev.Report();
                        }

                        break;

                    case REG_DWORD:
                        DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: %s => %d  [OK]"),
                                 lpValueName, *((LPDWORD)lpData)));
                        if (lpGPOInfo->dwFlags & GP_VERBOSE) {
                            CEvents ev(FALSE, EVENT_SET_DWORD_VALUE);
                            ev.AddArg(lpValueName); ev.AddArg((DWORD)*lpData); ev.Report();
                        }

                        break;

                    case REG_NONE:
                        break;

                    default:
                        DebugMsg((DM_VERBOSE, TEXT("SetRegistryValue: %s was set successfully"),
                                 lpValueName));
                        if (lpGPOInfo->dwFlags & GP_VERBOSE) {
                            CEvents ev(FALSE, EVENT_SET_UNKNOWN_VALUE);
                            ev.AddArg(lpValueName); ev.Report();
                        }
                        break;
                }


                if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                                   TEXT("Control Panel\\Colors"), 20, lpKeyName, 20) == 2) {
                    lpGPOInfo->dwFlags |= GP_REGPOLICY_CPANEL;

                } else if (CompareString (LOCALE_USER_DEFAULT, NORM_IGNORECASE,
                                   TEXT("Control Panel\\Desktop"), 21, lpKeyName, 21) == 2) {
                    lpGPOInfo->dwFlags |= GP_REGPOLICY_CPANEL;
                }


            }
            else
            {
                DebugMsg((DM_WARNING, TEXT("SetRegistryValue: Failed to set value <%s> with %d"),
                         lpValueName, lResult));
                xe = lResult;
                CEvents ev(TRUE, EVENT_FAILED_SET);
                ev.AddArg(lpValueName); ev.AddArgWin32Error(lResult); ev.Report();
                bRegOpSuccess = FALSE;
            }
        }
        else
        {
            DebugMsg((DM_WARNING, TEXT("SetRegistryValue: Failed to open key <%s> with %d"),
                     lpKeyName, lResult));
            xe = lResult;
            CEvents ev(TRUE, EVENT_FAILED_CREATE);
            ev.AddArg(lpKeyName); ev.AddArgWin32Error(lResult); ev.Report();
            bRegOpSuccess = FALSE;
        }
    }

    return bLoggingOk && bRegOpSuccess;
}


//*************************************************************
//
//  ProcessGPORegistryPolicy()
//
//  Purpose:    Proceses GPO registry policy
//
//  Parameters: lpGPOInfo       -   GPO information
//              pChangedGPOList - Link list of changed GPOs
//
//  Notes:      This function is called in the context of
//              local system, which allows us to create the
//              directory, write to the file etc.
//
//  Return:     TRUE if successful
//              FALSE if an error occurs
//
//*************************************************************

BOOL ProcessGPORegistryPolicy (LPGPOINFO lpGPOInfo,
                               PGROUP_POLICY_OBJECT pChangedGPOList, HRESULT *phrRsopLogging)
{
    PGROUP_POLICY_OBJECT lpGPO;
    TCHAR szPath[MAX_PATH];
    TCHAR szBuffer[MAX_PATH];
    TCHAR szKeyName[100];
    LPTSTR lpEnd, lpGPOComment;
    HANDLE hFile;
    DWORD dwTemp, dwBytesWritten;
    REGHASHTABLE *pHashTable = NULL;
    WIN32_FIND_DATA findData;
    ADMFILEINFO *pAdmFileCache = NULL;
    XLastError xe;

    //
    // Get the path name to the appropriate profile
    //

    *phrRsopLogging = S_OK;

    szPath[0] = TEXT('\0');
    dwTemp = ARRAYSIZE(szPath);

    if (lpGPOInfo->dwFlags & GP_MACHINE) {
        GetAllUsersProfileDirectoryEx(szPath, &dwTemp, TRUE);
    } else {
        GetUserProfileDirectory(lpGPOInfo->hToken, szPath, &dwTemp);
    }

    if (szPath[0] == TEXT('\0')) {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: Failed to get path to profile root")));
        return FALSE;
    }


    //
    // Tack on the archive file name
    //

    DmAssert( lstrlen(szPath) + lstrlen(TEXT("\\ntuser.pol")) < MAX_PATH );

    lstrcat (szPath, TEXT("\\ntuser.pol"));


    //
    // Delete any existing policies
    //

    if (!ResetPolicies (lpGPOInfo, szPath)) {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: ResetPolicies failed.")));
        return FALSE;
    }


    //
    // Delete the old archive file
    //

    SetFileAttributes (szPath, FILE_ATTRIBUTE_NORMAL);
    DeleteFile (szPath);


    //
    // Recreate the archive file
    //

    hFile = CreateFile (szPath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
                        FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_READONLY | FILE_FLAG_SEQUENTIAL_SCAN,
                        NULL);


    if (hFile == INVALID_HANDLE_VALUE)
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: Failed to create archive file with %d"),
                 GetLastError()));
        return FALSE;
    }

    //
    // Set the header information in the archive file
    //

    dwTemp = REGFILE_SIGNATURE;

    if (!WriteFile (hFile, &dwTemp, sizeof(dwTemp), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(dwTemp))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: Failed to write signature with %d"),
                 GetLastError()));
        CloseHandle (hFile);
        return FALSE;
    }


    dwTemp = REGISTRY_FILE_VERSION;

    if (!WriteFile (hFile, &dwTemp, sizeof(dwTemp), &dwBytesWritten, NULL) ||
        dwBytesWritten != sizeof(dwTemp))
    {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: Failed to write version number with %d"),
                 GetLastError()));
        CloseHandle (hFile);
        return FALSE;
    }

    if ( lpGPOInfo->pWbemServices ) {

        //
        // If Rsop logging is enabled, setup hash table
        //

        pHashTable = AllocHashTable();
        if ( pHashTable == NULL ) {
            CloseHandle (hFile);
            *phrRsopLogging = HRESULT_FROM_WIN32(GetLastError());
            xe = GetLastError();
            return FALSE;
        }

    }

    //
    // Now loop through the GPOs applying the registry.pol files
    //

    lpGPO = pChangedGPOList;

    while ( lpGPO ) {

        //
        // Add the source GPO comment
        //

        lpGPOComment = (LPTSTR) LocalAlloc (LPTR, (lstrlen(lpGPO->lpDisplayName) + 25) * sizeof(TCHAR));

        if (lpGPOComment) {

            lstrcpy (szKeyName, TEXT("Software\\Policies\\Microsoft\\Windows\\Group Policy Objects\\"));
            lstrcat (szKeyName, lpGPO->szGPOName);

            lstrcpy (lpGPOComment, TEXT("**Comment:GPO Name: "));
            lstrcat (lpGPOComment, lpGPO->lpDisplayName);

            if (!ArchiveRegistryValue(hFile, szKeyName, lpGPOComment, REG_SZ, 0, NULL)) {
                DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: ArchiveRegistryValue returned false.")));
            }

            LocalFree (lpGPOComment);
        }


        //
        // Build the path to registry.pol
        //

        DmAssert( lstrlen(lpGPO->lpFileSysPath) + lstrlen(c_szRegistryPol) + 1 < MAX_PATH );

        lstrcpy (szBuffer, lpGPO->lpFileSysPath);
        lpEnd = CheckSlash (szBuffer);
        lstrcpy (lpEnd, c_szRegistryPol);

        if (!ParseRegistryFile (lpGPOInfo, szBuffer, SetRegistryValue, hFile,
                                lpGPO->lpDSPath, lpGPO->lpLink, pHashTable, FALSE )) {
            xe = GetLastError();
            DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: ParseRegistryFile failed.")));
            CloseHandle (hFile);
            FreeHashTable( pHashTable );
            // no logging is done in any case
            return FALSE;
        }

        if ( lpGPOInfo->pWbemServices ) {

            //
            // Log Adm data
            //

            HANDLE hFindFile;
            WIN32_FILE_ATTRIBUTE_DATA attrData;
            DWORD dwFilePathSize = lstrlen( lpGPO->lpFileSysPath );
            TCHAR szComputerName[3*MAX_COMPUTERNAME_LENGTH + 1];
            DWORD dwSize;

            dwSize = 3*MAX_COMPUTERNAME_LENGTH + 1;
            if (!GetComputerName(szComputerName, &dwSize)) {
                DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: Couldn't get the computer Name with error %d."), GetLastError()));
                szComputerName[0] = TEXT('\0');
            }


            dwSize = dwFilePathSize + MAX_PATH;

            WCHAR *pwszEnd;
            WCHAR *pwszFile = (WCHAR *) LocalAlloc( LPTR, dwSize * sizeof(WCHAR) );

            if ( pwszFile == 0 ) {
                xe = GetLastError();
                DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: ParseRegistryFile failed to allocate memory.")));
                CloseHandle (hFile);
                FreeHashTable( pHashTable );
                // no logging is done in any case
                return FALSE;
            }

            lstrcpy( pwszFile, lpGPO->lpFileSysPath );

            //
            // Strip off trailing 'machine' or 'user'
            //

            pwszEnd = pwszFile + lstrlen( pwszFile );

            if ( lpGPOInfo->dwFlags & GP_MACHINE )
                pwszEnd -= 7;   // length of "machine"
            else
                pwszEnd -= 4;   // length of "user"

            lstrcpy( pwszEnd, L"Adm\\*.adm");

            //
            // Remember end point so that the actual Adm filename can be
            // easily concatenated.
            //

            pwszEnd = pwszEnd + lstrlen( L"Adm\\" );

            //
            // Enumerate all Adm files
            //

            hFindFile = FindFirstFile( pwszFile, &findData);

            if ( hFindFile != INVALID_HANDLE_VALUE )
            {
                do
                {
                    if ( !(findData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) )
                    {
                        DmAssert( dwFilePathSize + lstrlen(findData.cFileName) + lstrlen( L"\\Adm\\" ) < dwSize );

                        lstrcpy( pwszEnd, findData.cFileName);

                        ZeroMemory (&attrData, sizeof(attrData));

                        if ( GetFileAttributesEx (pwszFile, GetFileExInfoStandard, &attrData ) != 0 ) {

                            if ( !AddAdmFile( pwszFile, lpGPO->lpDSPath, &attrData.ftLastWriteTime,
                                              szComputerName, &pAdmFileCache ) ) {
                                DebugMsg((DM_WARNING,
                                          TEXT("ProcessGPORegistryPolicy: AddAdmFile failed.")));

                                if (pHashTable->hrError == S_OK)
                                    pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
                            }

                        }
                    }   // if findData & file_attr_dir
                }  while ( FindNextFile(hFindFile, &findData) );//  do

                FindClose(hFindFile);

            }   // if hfindfile

            LocalFree( pwszFile );

        }   //  if rsoploggingenabled

        lpGPO = lpGPO->pNext;
    }

    //
    // Log registry data to Cimom database
    //

    if ( lpGPOInfo->pWbemServices ) {

        if ( ! LogRegistryRsopData( lpGPOInfo->dwFlags, pHashTable, lpGPOInfo->pWbemServices ) )  {
            DebugMsg((DM_WARNING, TEXT("ProcessGPOs: Error when logging Registry Rsop data. Continuing.")));

            if (pHashTable->hrError == S_OK)
                pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
        }
        if ( ! LogAdmRsopData( pAdmFileCache, lpGPOInfo->pWbemServices ) ) {
            DebugMsg((DM_WARNING, TEXT("ProcessGPOs: Error when logging Adm Rsop data. Continuing.")));

            if (pHashTable->hrError == S_OK)
                pHashTable->hrError = HRESULT_FROM_WIN32(GetLastError());
        }

        *phrRsopLogging = pHashTable->hrError;
    }


    FreeHashTable( pHashTable );
    FreeAdmFileCache( pAdmFileCache );

    CloseHandle (hFile);

#if 0
    //
    // Set the security on the file
    //

    if (!MakeFileSecure (szPath, 0)) {
        DebugMsg((DM_WARNING, TEXT("ProcessGPORegistryPolicy: Failed to set security on the group policy registry file with %d"),
                 GetLastError()));
    }
#endif

    return TRUE;
}


//*************************************************************
//
//  AddAdmFile()
//
//  Purpose:    Prepends to list of Adm files
//
//  Parameters: pwszFile       - File path
//              pwszGPO        - Gpo
//              pftWrite       - Last write time
//              ppAdmFileCache - List of Adm files processed
//
//*************************************************************

BOOL AddAdmFile( WCHAR *pwszFile, WCHAR *pwszGPO, FILETIME *pftWrite, WCHAR *szComputerName,
                 ADMFILEINFO **ppAdmFileCache )
{
    XPtrLF<WCHAR> xszLongPath;
    LPTSTR pwszUNCPath;

    DebugMsg((DM_VERBOSE, TEXT("AllocAdmFileInfo: Adding File name <%s> to the Adm list."), pwszFile));
    if ((szComputerName) && (*szComputerName) && (!IsUNCPath(pwszFile))) {
        xszLongPath = MakePathUNC(pwszFile, szComputerName);

        if (!xszLongPath) {
            DebugMsg((DM_WARNING, TEXT("AllocAdmFileInfo: Failed to Make the path UNC with error %d."), GetLastError()));
            return FALSE;
        }
        pwszUNCPath = xszLongPath;
    }
    else
        pwszUNCPath = pwszFile;


    ADMFILEINFO *pAdmInfo = AllocAdmFileInfo( pwszUNCPath, pwszGPO, pftWrite );
    if ( pAdmInfo == NULL )
        return FALSE;

    pAdmInfo->pNext = *ppAdmFileCache;
    *ppAdmFileCache = pAdmInfo;

    return TRUE;
}


//*************************************************************
//
//  FreeAdmFileCache()
//
//  Purpose:    Frees Adm File list
//
//  Parameters: pAdmFileCache - List of Adm files to free
//
//
//*************************************************************

void FreeAdmFileCache( ADMFILEINFO *pAdmFileCache )
{
    ADMFILEINFO *pNext;

    while ( pAdmFileCache ) {
        pNext = pAdmFileCache->pNext;
        FreeAdmFileInfo( pAdmFileCache );
        pAdmFileCache = pNext;
    }
}


//*************************************************************
//
//  AllocAdmFileInfo()
//
//  Purpose:    Allocates a new struct for ADMFILEINFO
//
//  Parameters: pwszFile  -  File name
//              pwszGPO   -  Gpo
//              pftWrite  -  Last write time
//
//
//*************************************************************

ADMFILEINFO * AllocAdmFileInfo( WCHAR *pwszFile, WCHAR *pwszGPO, FILETIME *pftWrite )
{
    XLastError xe;

    ADMFILEINFO *pAdmFileInfo = (ADMFILEINFO *) LocalAlloc( LPTR, sizeof(ADMFILEINFO) );
    if  ( pAdmFileInfo == NULL ) {
        DebugMsg((DM_WARNING, TEXT("AllocAdmFileInfo: Failed to allocate memory.")));
        return NULL;
    }

    pAdmFileInfo->pwszFile = (WCHAR *) LocalAlloc( LPTR, (lstrlen(pwszFile) + 1) * sizeof(WCHAR) );
    if ( pAdmFileInfo->pwszFile == NULL ) {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("AllocAdmFileInfo: Failed to allocate memory.")));
        LocalFree( pAdmFileInfo );
        return NULL;
    }

    pAdmFileInfo->pwszGPO = (WCHAR *) LocalAlloc( LPTR, (lstrlen(pwszGPO) + 1) * sizeof(WCHAR) );
    if ( pAdmFileInfo->pwszGPO == NULL ) {
        xe = GetLastError();
        DebugMsg((DM_WARNING, TEXT("AllocAdmFileInfo: Failed to allocate memory.")));
        LocalFree( pAdmFileInfo->pwszFile );
        LocalFree( pAdmFileInfo );
        return NULL;
    }

    lstrcpy( pAdmFileInfo->pwszFile, pwszFile );
    lstrcpy( pAdmFileInfo->pwszGPO, pwszGPO );

    pAdmFileInfo->ftWrite = *pftWrite;

    return pAdmFileInfo;
}


//*************************************************************
//
//  FreeAdmFileInfo()
//
//  Purpose:    Deletes a ADMFILEINFO struct
//
//  Parameters: pAdmFileInfo - Struct to delete
//              pftWrite   -  Last write time
//
//
//*************************************************************

void FreeAdmFileInfo( ADMFILEINFO *pAdmFileInfo )
{
    if ( pAdmFileInfo ) {
        LocalFree( pAdmFileInfo->pwszFile );
        LocalFree( pAdmFileInfo->pwszGPO );
        LocalFree( pAdmFileInfo );
    }
}