I created a Settings catalog policy to block regedit for Eagle.Talon:

Issues: Policy blocked LocalAdmin unexpectedly (DisableRegistryTools = 2 in HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System). Eagle.Talon wasn’t blocked.

Steps: Devices > Configuration > New policy > Settings catalog > “Prevent access to registry editing tools” Enabled, “Disable regedit from running silently” Yes > Assign to “NotepadDenyUsers”.

Fixes:

Removed legacy registry key with PowerShell.

Ran SFC /scannow (no issues) and GPUpdate /force.

Checked gpedit.msc (Not Configured).

Ongoing: Recreating as user-targeted policy with “Disable regedit from running silently” No for clear error messages.

Key Takeaway:

User policies apply to HKCU, not HKLM—test across accounts and use PowerShell for registry checks.