Technical Guides
      Back to home
      1. Knowledge Base
      2. Technical Guides

      Create a GPO to remove Enforcement (CP Filter)

      If you want to remove the enforcement for WLM on a machine, you can create a GPO to do this.

      You can use a GPO to delete the relevant keys related to the enforcement of our WLM on Windows machines.  The simple method is to set up the GPO with 2 Registry items, set to delete, and specify the hives/paths as shown here: 
      image 3
      To do the above:
      Add a Registry item, selecting Delete as the action:
       
      image 6
      image 2
       
      Select the item shown above, no need to select anything else, though you can add a second registry item to delete the CLSID entry was well if you want.
       
      image 4
       
      And that should be it.  Click OK and apply that to the OU you want to use to un-enforce our WLM. 
      You would move the machine to an OU that does not have the enforcement enabled and link the un-enforcement policy to pull that/those two keys out. 
      Also, in the enforcement GPO, I recommend you keep the actions set to update and do not choose the option to remove the items if no longer applied.  This will reduce the chances of having only some of the items removed but not the CP filter key which leaves Windows confused about what to present for a login dialog.   It is better to use the un-enforcement GPO to remove the relevant keys completely.
      Please test this on a VM or other system that is not a production system.
      Note that the removal of the CP Filter can also be achieved by importing a .reg file with this content: (taken from our remove.reg file)
       
      Windows Registry Editor Version 5.00

      [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{466285C7-BBF8-4874-B9A7-898CFD27837F}]
      [-HKEY_CLASSES_ROOT\CLSID\{466285C7-BBF8-4874-B9A7-898CFD27837F}]
       
      If you need to remove all the relevant SurePassID keys: (remove all including the settings used to make the WLM viable)
       
      Windows Registry Editor Version 5.00

      [-HKEY_LOCAL_MACHINE\SOFTWARE\SurePassId]
      [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{B07DBC39-6E19-4E60-9CC3-3C8A8817E0E2}]
      [-HKEY_CLASSES_ROOT\CLSID\{B07DBC39-6E19-4E60-9CC3-3C8A8817E0E2}]
      [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{466285C7-BBF8-4874-B9A7-898CFD27837F}]
      [-HKEY_CLASSES_ROOT\CLSID\{466285C7-BBF8-4874-B9A7-898CFD27837F}]