HKLM - how to deal with apps that write there ?

[Douglas42Adams]

So i thought Google Drive File Stream was working great.  After about 7 reboots of working fine and auto-loggin in the person -  it fails to start on boot up and the user has to re-login .

So it is correct that UEM will not being over HKLM reg entries ?  We looked at the GDFS keys and USER has been given access to the HKLM keys .  So in theory it should work ?

GDFS Keeps the user logged in for about 5 reboots.. and some the user is logged out and has to re log in.

We have GDFS installed on the GI.. not using an app stack.  We are using writables / UEM and app volumes / Instant clones .

If an app is writing to HKLM .. how does one bring that into UEM ?

If 'user' has rights to those HKLM keys is that good enough ?..

Can i use the Privlege Elevation part of UEM ?.. Do i grant the GDFS app the Elevated rights ?... Anyone know of any good walkthroughs on the "Privilege Elevation' part of UEM ?

I just find it Odd that GDFS works part of the time and not others. Kinda wish it would just pick one :smileysilly: .

thanks .

[DEMdev]

Hi Douglas42Adams,

Although UEM is meant to work with user profile settings (i.e. HKCU), as long as the user has modify permissions to the relevant HKLM keys, this should work fine. By default, non-admin users won't have that permission, though, so it would be up to you to tweak that. (In other words, what ijdemes said in the original Google Drive File Stream thread 🙂

However, looking at that Configure Drive File Stream - G Suite Admin Help​ link you provided in that thread, I get the impression that those three locations (HKCU, HKLM, HKLM\...\Policies) are just three ways for an admin to provide configuration, where one overrides the other(s). If you look into the exported .REG file from a session where everything is working fine (i.e. the user did not have to re-login), do you see anything that looks like credentials or a token?