problem executing the session_setup() function

[brice73]

Good morning,

I have a package that needs to delete two values ​​from a registry key (if those values ​​exist) within the session_setup function. Here is the code:

Code: Select all

def session_setup():

    nom_PC=get_computername().lower()

    if "pm" in nom_PC:
        if reg_value_exists(HKEY_CURRENT_USER,'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System','Wallpaper') :
            registry_delete(HKEY_CURRENT_USER,'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System','Wallpaper')

        if reg_value_exists(HKEY_CURRENT_USER,'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System','WallpaperStyle'):   
            registry_delete(HKEY_CURRENT_USER,'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System','WallpaperStyle')

Once the package is installed and when a user for whom both values ​​in the key exist logs on, these two values ​​are not deleted.

If I open a command prompt and manually run the session-setup function for this package, I get the following error:

Code: Select all

Microsoft Windows [version 10.0.26100.6584]
(c) Microsoft Corporation. Tous droits réservés.

U:\>wapt-get session-setup col73-pi-fonds-ecran
Using config file: C:\Program Files (x86)\wapt\wapt-get.ini
Configuring col73-pi-fonds-ecran ...
Running session_setup for package col73-pi-fonds-ecran(=0-11) and user test
2025-09-29 17:12:08,371 CRITICAL Fatal error in session_setup function: AttributeError: __enter__:
Traceback (most recent call last):
  File "C:\Program Files (x86)\wapt\waptpackage.py", line 3004, in call_setup_hook
    hookdata = hook_func()
  File "<string>", line 43, in session_setup
  File "C:\Program Files (x86)\wapt\setuphelpers_windows.py", line 3862, in registry_delete
    with reg_openkey_noredir(root, path, sam=KEY_WRITE) as key:
AttributeError: __enter__

2025-09-29 17:12:08,387 CRITICAL session_setup failed for package col73-pi-fonds-ecran(=0-11) and user test
Done

However, if I open a command prompt with administrator privileges and run the session-setup function for this package, it executes successfully (I verify that the 2 values ​​in the registry key are indeed deleted):

Code: Select all

Microsoft Windows [version 10.0.26100.6584]
(c) Microsoft Corporation. Tous droits réservés.

C:\Windows\System32>wapt-get session-setup col73-pi-fonds-ecran
Using config file: C:\Program Files (x86)\wapt\wapt-get.ini
Configuring col73-pi-fonds-ecran ...
Running session_setup for package col73-pi-fonds-ecran(=0-11) and user test
Done

Where could the problem be coming from and is there a way to make the session-setup() function run automatically for each user when they log in?

[sfonteneau]

Hello

, it seems you can't because the ACLs set by default to "Policies" don't allow the user to modify this key.

The session-setup runs with user privileges and therefore doesn't have the necessary permissions.

[brice73]

Hello Simon,

thank you for your reply. Although it's a bit illogical, I thought session_setup() ran with system account privileges... I found another way to do it (using LGPO.exe).

You can mark the thread as resolved.

Regards,

[dcardon]

Hi Brice,

Thank you for your reply. Although it's not very logical, I thought session_setup() ran with system account privileges... I found another way to do it (using LGPO.exe).

You can mark the thread as resolved.

Thank you for your feedback. If you have the setup.py file handy, please feel free to share it. If you've asked this question, it's likely others will have the same one.

Note: lgpo.exe is free but cannot be redistributed (restrictive and explicit Microsoft proprietary license on the subject), so it cannot be put on the store, but it can still serve as an example for others.

Sincerely,

Denis

[brice73]

Hello Denis,

Why not, it didn't seem useful to me (the setup.py is also very short).

A short file (in PDF format) from Microsoft on the use of LGPO.exe is quite explicit. Several packages in our infrastructure use LGPO.exe to configure local GPOs (in addition to GPOs enabled at the domain level in Active Directory).

To disable a user GPO, I initially thought it was better and simpler to use session_setup(), for users for whom the GPO had already been activated because it was causing the creation of keys in HKCU, which it seemed sufficient to delete a priori.

So, I ended up reusing LGPO to disable the user GPO in question for all users. Below is the setup.py file with some comments on its use (but the Microsoft documentation is much more complete).

Code: Select all

# -*- coding: utf-8 -*-
from setuphelpers import *

r"""Ce paquet a comme dépendance col73-pi-debloat-windows-peda car il faut auparavant désactiver windows à la une (windows spotlight) qui modifie automatiquement régulièrement les fonds d'écran
"""

def install():

    nom_PC=get_computername().lower()

    #forçage du fonds d'écran seulement pour les postes élèves
    if not "pm" in nom_PC:

        #fixe le fond d'écran (celui par défaut de Windows)
        #GPO Configuration Utilisateur > Modèles d'administration > Bureau > papier peint du bureau > activé)
        #chemin du fonds d'écran appliqué : C:\Windows\Web\Wallpaper\Windows\img0.jpg
        print('poste élève -> paramétrage du fonds d\'écran via gpo locale')
        run_notfatal(r'.\GPO\LGPO.exe /q /u .\GPO\activate_gpo_u_fonds_ecran.pol')
        print('fonds d\'écran paramétré')

        print('forçage des maj gpo')
        run_powershell(r'Start-Process PowerShell -Verb runAs -Wait -ArgumentList "gpupdate /target:user /force"')
        print('forçage des maj gpo effectué')

    else:
        print('poste professeur -> pas de paramétrage du fonds d\'écran')

        #pour l'annulation du forçage déjà effectué sur les postes professeurs dans une version antérieure du paquet
        #GPO Configuration Utilisateur > Modèles d'administration > Bureau > papier peint du bureau > désactivé
        #exporter le fichier de configuration en mode texte avec LGPO.exe, ne conserver que les lignes de désactivation de la gpo (éditer le fichier avec notepad)
        #puis exporter le fichier .txt en fichier .pol toujours avec LGPO.exe -> on obtiens le fichier de désactivation à appliquer

        run_notfatal(r'.\GPO\LGPO.exe /q /u .\GPO\desactivate_gpo_u_fonds_ecran.pol')

        print('forçage des maj gpo')
        run_powershell(r'Start-Process PowerShell -Verb runAs -Wait -ArgumentList "gpupdate /target:user /force"')
        print('forçage des maj gpo effectué')

You can mark the thread as resolved. Thank you

Sincerely,