Win 10 gpos on 2008r2

[TheICTTechnician]

Hi all,

 

We are mostly a Windows 7 network running off 2 2008r2 servers. We now however have taken delivery of 1 trolley set of Windows 10 pro laptops. These have been added to the domain and are working great and the GPOs which were already in place work with Windows 7 and 10. However, the 10 laptops need to be locked down more, is it okay to download the Windows 10 admx gpo templates and get them running on our 2008r2 server?

 

Thanks

[3s-gtech]

Yup. You'll struggle with some settings where there's no mechanism for them on 2008 R2, like Applocker for Modern UI apps. In those cases, you'll need to use RSAT on Windows 10.

[Michael]

Yes, you need to create a PolicyDefinitions folder within: C:\Windows\SYSVOL\sysvol\%domainname%\Policies\PolicyDefinitions

 

Within that, you should have en-US (for language files) and admx files in the root. You can also add Office Resource Kit (ORK Tools) within here too to manage Office.

[TheICTTechnician]

And these will all run fine along with the current gpos?

[Michael]

It depends - do you have a PolicyDefinitions folder already? If yes, then it depends what's in that.

 

If you don't then it just means you're managing Windows. Windows GPOs are cumulative, so will contain settings from Win 2000 to Windows 10.

 

Office GPOs or other are not. You just download the correct ORK Tools for your version(s) of Office, so you could for example manage Office 2010, 2013 and 2016 using their GPO sets.

 

Optionally you can manage Chrome and Classic Shell this way too... Good luck!

[TheICTTechnician]

We dont have a PolicyDefinitions folder within SYSVOL currently no.

[Michael]

Then you're good to go, there should be no problems.

[3s-gtech]

These will replace the current ADMX templates if you're using them. The GPOs themselves will remain. You can use them alongside existing GPOs or modify the existing ones.

[Michael]

Yes, if you later remove the PolicyDefinitions folder, Windows Server will revert back to its default database of files until a new PolicyDefinitions folder is created.

 

As I say, in mine I include policies for Windows, Office 2016, Classic Shell and Chrome.

[TheICTTechnician]

Okay thanks, all installed and sorted, A few ive tried aren't working at the minute (Remove windows store and OneDrive), are the majority compatible with 10 Pro? Reading in places that some arent.

 

Thanks

[3s-gtech]

Generally, schools on here are using Windows 10 Edu or Enterprise to avoid some of these issues, but the majority of policies work with Pro.

[Michael]

Some GPOs will not work with Pro. All GPOs will work with Ent/Edu where applicable.