Readme update: Puppet applies new and updated policy - Routine gpupdate is required to reapply existing policy

[chambersmp]

Request update to README section 'Limitations'

Puppet agent will only apply new and updated local group policy values defined in the Puppet manifest.
Puppet will not revert manual registry changes made by end users via regedit.
Gpupdate must be used to reapply existing policy settings.

Problem

Puppet agent does not identify configuration drift when end user modifies group policy managed registry values via regedit.

Example:

1. Admin defines policy in Puppet manifest, policy should be enabled.

  advanced_security_policy { 'Disallow Autoplay for non-volume devices':
    ensure       => present,
    policy_value => 'enabled',
  }

2. Puppet runs, parses the policy and sets it to enabled in LGPO.
3. LGPO sets the registry value to 1.
4. End user opens regedit, changes the value to 0.
5. Puppet runs again, finds policy is compliant and no changes required. The registry is still 0 instead of 1.
6. As policy is correct, admin runs gpupdate /force to reapply all policies to correct the registry.
7. Registry value reverts to 1 as defined by policy.
8. Machine is compliant to policy.

Recommended Local Policies To Ensure Registry Remains Compliant :

Make sure you have the following Local Group Policies configured to ensure group policies are reapplied during routine 'gpupdate':
1.'Configure Registry Policy Processing: Process even if the Group Policy objects have not changed' = enabled
2.'Configure Security Policy Processing: Process even if the Group Policy objects have not changed' = enabled
3.'Set Group Policy refresh interval for computer' = enabled

By default, Domain members will refresh group policy every 90 minutes. Standalone (workgroup) server do not do this automatically. The two policy processing policies allow the routine 'gpupdate' to reapply all policies which guards against end user modification of registry. This works similar to gpupdate /force.

References:

• 'Group Policy Refresh Interval'
• 'Group policy doesn't refresh unless changed'