Gpdisable is a tool to bypass group policy as a limited user, posted by Marc Russinovich on his blog when he was still the owner of Sysinternals. But now that Sysinternals is owned by Microsoft, the tool is not available anymore.
My Basic Process Manipulation Tool Kit can replace Gpdisable, I’ll show how and give you one more trick.
LikeMarc did, you can inject a DLL that will patch the IAT to subvert NtQueryValueKey, but I’ll leave this technique for an upcoming post.
My example doesn’t require you to program a DLL to inject: since we want to hide the TransparentEnabled registry key, we will just rename the key in the process memory of the programs that impose Software Restriction Policies on us (like explorer.exe). Here is the bpmtk config file to achieve this goal:
dll-name advapi32.dll #rename TransparentEnabled to AransparentEnabled search-and-write module:. unicode:TransparentEnabled ascii:A
This will patch each process you’ve rights to and who has loaded advapi32.dll (this DLL enforces SRP).
But as Mark writes in his blog, this will not work for running processes because they have already cached the value of TransparentEnabled and are thus not querying the registry anymore. This is why many people reported that Gpdisable didn’t work for them. Gpupdate /force will force a refresh of the policies, and invalidate the cache.
But if you’re in a restricted environment, there’s a chance you’re prevented from doing a gpupdate. Here’s another way: set the variable _g_bInitializedFirstTime to 0, this will also invalidate the cache. For advapi32.dll version 5.1.2600.2180, this variable is at address 77E463C8. Our script becomes:
dll-name advapi32.dll #rename TransparentEnabled to AransparentEnabled search-and-write module:. unicode:TransparentEnabled ascii:A write version:5.1.2600.2180 hex:77E463C8 hex:00
Didier Stevens 
[…] Stevens @ 13:44 After having showed you how my Basic Process Manipulation Tool Kit can be used to bypass Software Restriction Policies, I wanted to follow this with a post showing how SRP whitelisting can prevent this. However, while […]
Pingback by bpmtk: How About SRP Whitelists? « Didier Stevens — Thursday 5 June 2008 @ 13:51
Hi, you have very useful site
You can get Gpdisable from webarchive
http://web.archive.org/web/20061231193919/http://www.sysinternals.com/files/gpdisable.zip
Comment by Michael — Saturday 2 January 2010 @ 17:49
Seclogon service can block gpdisable and similar tools.
1. Right click on gpdisable.exe
2. Click “Run as…”
3. Flag “Protect computer….” must be set
4. Click ok
Result: Gpdisable.dll is not injected.
Comment by Guest — Saturday 3 September 2011 @ 11:46