ADMX Template

[Gongalong]

Hi All,

 

Is there a single ADMX template for all branches of Win 10, or are they build specific?

 

(Google picks up a couple of different types for download from Microsoft, albeit one that's Win 10, and the other is Win 10 and Server 2016)

 

Thanks

[sted]

theres one for every version so 1511 has a set 1703 has a set just pick the newest it contains the settings from the older ones and any additions. if you mean pro/ent/edu no its all the same just some settings will work on ent/edu and not on pro

[3s-gtech]

The 1703 templates will manage everything from 1703 back to Windows 2000, and everything in between.

[Gongalong]

Thanks both.

 

Is this the latest set? Dated 8th Jan 2017

 

https://www.microsoft.com/en-us/download/details.aspx?id=53430

 

Or is there a de facto place to get them from elsewhere?

[DJ-1701]

That appears to be the latest set for Windows 10 and 2016 common ADMX... but doesn't include the latest ADMX for 1703 released on the 11th of April.

 

It would be worth downloading both sets and placing the 1703 ADMX on top. https://www.microsoft.com/en-us/download/details.aspx?id=55080

[Gongalong]

Am I right in thinking this is the correct method to update the templates? https://blogs.technet.microsoft.com/canitpro/2015/10/20/step-by-step-managing-windows-10-with-administrative-templates/

 

I'm sure previously I just copied them into C:\Windows\PolicyDefinitions, this was when adding templates for Google Chrome.

 

If using the method in the link above, how does Group Policy know where to fetch the templates from?!

[Gongalong]

This shows to install the MSIs on the DC in the C:\Windows directory, so going with this!

[3s-gtech]

The .msi just extracts them to a specified place. I don't do that to my domain PolicyDefinitions because it will include .adml files for all languages - I just cherry pick which ones go from the extracted folder (usually within Documents) into my sysvol. Don't bother putting the templates into C:\Windows\PolicyDefinitions, they won't work on the domain. They need to be in \\domain.com\sysvol\domain.com\Policies\PolicyDefinitions.

[Gongalong]

And presumably group policy just picks them up from that location?

 

I'm sure I put the Google Chrome ADMX files into C:\Windows\PolicyDefinitions, and they seem to be working across the domain.

[Gongalong]

Hmmm, well coincidentally I was after a recent GP item that *didn't* display despite theoretically updating C:\Windows\PolicyDefinitions. So I coped first the Win 10 and Server 2016 files to the relevant SYSVOL folder, then updated with the Creator Update files, and now I see the relevant option. So not sure what happened, but updating SYSVOL does appear to be crucial.

[3s-gtech]

C:\Windows\PolicyDefinitions is the local policydefinitions folder. In theory, the DC you install it on will see it in Group Policy Management (in practice, not sure) but clients would not be able to resolve that location for the policy unless you used a script to copy the ADMXs to their local C:\Windows\PolicyDefinitions folder too. How the Chrome ones work I don't know.

 

Yes, GP just reads them in GPMC and they'll show up when you come to edit a policy.

[Geoff]

You should always update your central store as it is less headaches for everyone.

 

https://support.microsoft.com/en-us/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows

[Gongalong]

How the Chrome ones work I don't know.

It's odd, because I just put them in C:\Windows\PolicyDefinitions on the DC. I did some testing, and they did seem to have taken effect on clients.

 

This didn't happen with the Creators Update setting though, that seemed to need it in SYSVOL, even to be seen on the DC.

[Geoff]

Thats because it depends what version of windows you are using, from the link I posted above:

 

In Group Policy for versions of Windows that are earlier than Windows Vista, if you change Administrative Templates policy settings on local computers, the Sysvol share on a domain controller within your domain is automatically updated to include the new .ADM files. Those changes are then replicated to all other domain controllers in the domain. This might increase the network load and storage requirements.

 

In Group Policy for Windows Server 2012 R2 and Windows 8.1, if you change Administrative Templates policy settings on local computers, Sysvol is not automatically updated to include the new .admx or .adml files. This change in behavior is implemented to reduce network load and disk storage requirements and to prevent conflicts between .admx and .adml files when changes are made to Administrative Templates policy settings across different locations.

[Gongalong]

The Chrome ADMX files were only put on the DC though (2012 R2). Clients are a mix of Win 7 and 10.

 

I did the same with putting the Win 10 ADMX files locally on the DC, initially.