Windows 10 Domain Group Policies

[timbo343]

A dumb question but where do we put the downloaded Group Policies on Server 2012r2? Documents online state \\DOMAIN\SysVol\DOMAIN\Policies and then PolicyDefinitions however all i see in the Policies folder is {RandomCharacters} which i guess are policies. What happens if i create a Policies Definition folder?

 

Does my domain and forest need to be upgraded to 2012r2?

[Sagima]

Yes you create a policydefinitions folder in that directory and dump the group policies you downloaded into it (that is your central store) - your office and chrome etc policies go in there too. Once you've done it there will be a load folders with language shortname (like en-gb, en-us etc) and a lot of things that end .admx to go in that folder

[timbo343]

Thanks didnt want to break owt so thought id double check

[3s-gtech]

If you create a PolicyDefinitions folder, you will then have a Central Store! That's the normal procedure. No need to upgrade your domain or anything, it's literally just create that folder and plonk the admx files in there. Make sure you have the en-US folder within it where your matching adml files go too.

[timbo343]

Next question. Does anyone know the WMI id so these policies only apply to Win10 machines?

[Sagima]

A dumb question but where do we put the downloaded Group Policies on Server 2012r2? Documents online state \\DOMAIN\SysVol\DOMAIN\Policies and then PolicyDefinitions however all i see in the Policies folder is {RandomCharacters} which i guess are policies. What happens if i create a Policies Definition folder?

 

Does my domain and forest need to be upgraded to 2012r2?

 

Update the domain if you want to use new features associated with it and you have domain controllers with a newer operating system. Update the forest if there are any features you want that become available for you at the higher level. I have updated to 2008R2 to use the fine grained password and recycle bin but there wasn;t anything too exciting in the 2012 and 2012r2 updates to get me to upgrade

Edited March 31, 2016 by Sagima

[Sagima]

Next question. Does anyone know the WMI id so these policies only apply to Win10 machines?

 

Mine is

 

root\cimv2

 

select * from Win32_OperatingSystem where Version like "10.%"

[3s-gtech]

Mine is:

 

select Version,ProductType from Win32_OperatingSystem where Version like "10.%" and ProductType = "1"

 

Not sure what else that does over the simpler one above!

[Sagima]

Yours restricts itself to the desktop OS so is probably better. My filter would apply to the server version (if it existed) as well if it used the same versioning Edited March 31, 2016 by Sagima

[Arthur]

Select * from Win32_OperatingSystem where Version like "10.%"

Also worth mentioning is that you can speed up that WMI query by simply changing the asterisk to the WMI attribute(s) you are querying (in this case "Version"). i.e.

 

Select [color="#FF0000"]Version[/color] from Win32_OperatingSystem where Version like "10.%"

 

The following PowerShell commands (taken from the linked article) can be used to measure the performance of each WMI query.

 

How Group Policy Impacts Logon Performance #3: WMI Filters & ILT

 

Measure-Command {

   for($i=0; $i -lt 1000; $i++) { 
       Get-WmiObject -query "SELECT * FROM Win32_OperatingSystem WHERE Version LIKE '10.%'"
   }

} | Select TotalMilliseconds

Measure-Command {

   for($i=0; $i -lt 1000; $i++) { 
       Get-WmiObject -query "SELECT Version FROM Win32_OperatingSystem WHERE Version LIKE '10.%'"
   }

} | Select TotalMilliseconds

 

Edit. @3s-gtech's WMI query would be better since you won't want the GPO to apply to Windows 10 and Windows Server 2016.

 

Edit 2. I think I got the maths wrong. The percentage change is 262.5%, while the percentage difference is actually 113.5%.

 

Still worth doing though.

Edited March 31, 2016 by Arthur

[Sagima]

Also worth mentioning is that you can speed up that WMI query by 260% by simply changing the asterisk to the WMI attribute(s) you are querying (in this case "Version"). i.e.

 

Select [color="#FF0000"]Version[/color] from Win32_OperatingSystem where Version like "10.%"

 

The 260% figure came from running the following PowerShell commands to measure the performance of each WMI query.

 

How Group Policy Impacts Logon Performance #3: WMI Filters & ILT

 

Measure-Command {

   for($i=0; $i -lt 1000; $i++) { 
       Get-WmiObject -query "SELECT * FROM Win32_OperatingSystem WHERE Version LIKE '10.%'"
   }

} | Select TotalMilliseconds

Measure-Command {

   for($i=0; $i -lt 1000; $i++) { 
       Get-WmiObject -query "SELECT Version FROM Win32_OperatingSystem WHERE Version LIKE '10.%'"
   }

} | Select TotalMilliseconds

 

Well I'm going to do that right now! 25000ms to 6000ms (still seems quite long)

Edited March 31, 2016 by Sagima