- It doesn’t create the registry keys instead it simply sets the *registry permissions* if the keys exist
- It ensures defined permissions are enforced on the configured registry keys at every run of gpupdate
- It doesn’t remove the permissions from registry key
If the GPO is denied for the computer
If registry keys from the GPO is removed.
