Enabled — Customize message for Access Denied errors

Description

This policy setting specifies the message that users see when they are denied access to a file or folder. You can customize the Access Denied message to include additional text and links. You can also provide users with the ability to send an email to request access to the file or folder to which they were denied access. If you enable this policy setting, users receive a customized Access Denied message from the file servers on which this policy setting is applied. If you disable this policy setting, users see a standard Access Denied message that doesn't provide any of the functionality controlled by this policy setting, regardless of the file server configuration. If you do not configure this policy setting, users see a standard Access Denied message unless the file server is configured to display the customized Access Denied message. By default, users see the standard Access Denied message.

Options

ErrorMessage multiText

EmailMessage multiText

Enable users to request assistance

AllowEmailRequests boolean - default: 0

Folder owner

PutDataOwnerOnTo boolean - default: 1

File server administrator

PutAdminOnTo boolean - default: 1

Include device claims

IncludeDeviceClaims boolean - default: 1

Include user claims

IncludeUserClaims boolean - default: 1

Log emails in Application and Services event log

GenerateLog boolean - default: 1

Additional recipients:

AdditonalEmailTo text

Export Builder

BETA

Configure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.

These exports write the registry — this is not a managed GPO. ⓘ

Not configured Enabled Disabled

ErrorMessage

EmailMessage

Enable users to request assistance

Folder owner

File server administrator

Include device claims

Include user claims

Log emails in Application and Services event log

Additional recipients:

.reg file

Windows Registry Editor Version 5.00

; Exported from gporais.com
; Policy: Customize message for Access Denied errors
; State: Enabled
; Supported on: At least Windows Server 2012, Windows 8 or Windows RT

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]
"Enabled"=dword:00000001
"ErrorMessage"=hex(7):00,00
; REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
"EmailMessage"=hex(7):00,00
; REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
"AllowEmailRequests"=dword:00000000
"PutDataOwnerOnTo"=dword:00000001
"PutAdminOnTo"=dword:00000001
"IncludeDeviceClaims"=dword:00000001
"IncludeUserClaims"=dword:00000001
"GenerateLog"=dword:00000001
"AdditonalEmailTo"=""

More formats (PowerShell, Intune, SCCM)

PowerShell

# Exported from gporais.com
# Policy: Customize message for Access Denied errors
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ErrorMessage' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'EmailMessage' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'AllowEmailRequests' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'PutDataOwnerOnTo' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'PutAdminOnTo' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IncludeDeviceClaims' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IncludeUserClaims' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'GenerateLog' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AdditonalEmailTo' -Value '' -Type String

Intune XML

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_srmfci/AccessDeniedConfiguration
Data type: String
Value:
<enabled/>
<!-- ErrorMessageText: enter one value per line before copying this XML payload. -->
<!-- EmailMessageText: enter one value per line before copying this XML payload. -->
<data id="AllowEmailRequestsCheck" value="0"/>
<data id="PutDataOwnerOnToCheck" value="1"/>
<data id="PutAdminOnToCheck" value="1"/>
<data id="IncludeDeviceClaimsCheck" value="1"/>
<data id="IncludeUserClaimsCheck" value="1"/>
<data id="GenerateLogCheck" value="1"/>
<data id="AdditonalEmailToText" value=""/>

Intune Remediation

# === Detection script ===
# Exported from gporais.com
# Policy: Customize message for Access Denied errors
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'Enabled' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'ErrorMessage' -Expected @() -Kind MultiString)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'EmailMessage' -Expected @() -Kind MultiString)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'AllowEmailRequests' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'PutDataOwnerOnTo' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'PutAdminOnTo' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'IncludeDeviceClaims' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'IncludeUserClaims' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'GenerateLog' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'AdditonalEmailTo' -Expected '' -Kind String)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Customize message for Access Denied errors
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ErrorMessage' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'EmailMessage' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'AllowEmailRequests' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'PutDataOwnerOnTo' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'PutAdminOnTo' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IncludeDeviceClaims' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IncludeUserClaims' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'GenerateLog' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AdditonalEmailTo' -Value '' -Type String

SCCM scripts

# Exported from gporais.com
# Policy: Customize message for Access Denied errors
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.

# === Detection script ===
# Exported from gporais.com
# Policy: Customize message for Access Denied errors
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'Enabled' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'ErrorMessage' -Expected @() -Kind MultiString)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'EmailMessage' -Expected @() -Kind MultiString)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'AllowEmailRequests' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'PutDataOwnerOnTo' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'PutAdminOnTo' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'IncludeDeviceClaims' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'IncludeUserClaims' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'GenerateLog' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'AdditonalEmailTo' -Expected '' -Kind String)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Customize message for Access Denied errors
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ErrorMessage' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'EmailMessage' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'AllowEmailRequests' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'PutDataOwnerOnTo' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'PutAdminOnTo' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IncludeDeviceClaims' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IncludeUserClaims' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'GenerateLog' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AdditonalEmailTo' -Value '' -Type String

Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.

Open the Builder

Search GPORais

Customize message for Access Denied errors

Path in the GPO console

Description

Registry

Options

MDM / Intune (CSP)

Export Builder

.reg file

PowerShell

Intune XML

Intune Remediation

SCCM scripts

Embed this policy on your site

Customize message for Access Denied errors

Path in the GPO console

Description

Registry

Options

MDM / Intune (CSP)

Export Builder

.reg file

PowerShell

Intune XML

Intune Remediation

SCCM scripts

Related settings

In the same console folder: “Access-Denied Assistance”