There is such a requirement that when a user modifies a certain item of the group policy, the corresponding registry will change, but how the two correspond is more difficult to find, someone summed it up
However, there are many items in the group policy, and the above summary is not complete. For example, what I want to read is
Group Policy\Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions
Prohibit the installation of devices not described by other policy settings. The value of this item has not been found for a long time.
So I want to change my mind, if we can intercept the writing of the registry when changing the group policy, we can find the relevant location.
So I used the "Tinder Sword" in the Tinder software, because running gpedit.msc is actually mmc.exe to open gpedit.msc
So I added a mmc.exe filter and found it