ADMX - GPO folders missing...

[Koldov]

Just looked through some of my GPOs and noticed we have a WSUS GPO that is now displaying 99% of the settings as 'extra registry settings'.

 

It is giving me this explanation:

 

'Display names for some settings cannot be found. You might be able to resolve this issue by updating the .ADM files used by Group Policy Management.'

 

However, I can't see any newer ADMX files to download for the version of Windows we have deployed.

 

A quick search leads me to these:

 

https://www.microsoft.com/en-us/down....aspx?id=57576

 

But I have those already on the server... They were fine and I don't think I've made any changes (apart from the normal Windows updates) for these not to be viable anymore ...

 

In fact looking through our GPOs there quite a few displaying this behaviour....

 

I might be going a bit mad, but I can't even seem to find this:

 

Computer Configuration > Policies > Administrative Templates > Windows components > Windows Update.

 

Although I don't take a lot of notice of the other settings that I am not directly configuring, now I look at them there does seem to be a few strange folders that I haven't noticed before...

 

OK, so a bit more Google-fu leads me to these...

 

https://social.technet.microsoft.com...um=winserverGP

 

https://community.spiceworks.com/top...ing-admx-files

 

https://arstechnica.com/civis/viewtopic.php?p=25815229

 

One of those posts is from 2013, one from 2019 and one from 2020, so it must be a known issue..?

 

I just can't quite work out why it has happened now as this must only have changed in the last month or so, but they all seem to come to the same solution:

 

"adding all of the admx files from c:\windows\policydefinitions to c:\windows\sysvol\sysvol\\policies\policydefinitions(the central store)"

 

"copy WindowsUpdate.admx from C:\Windows\PolicyDefinitions to \\yourdoman.com\SYSVOL\ yourdoman.com\Policies\PolicyDefinitions; copy WindowsUpdate.adml from C:\Windows\PolicyDefinitions\en-US to \\yourdoman.com\SYSVOL\ yourdoman.com\Policies\PolicyDefinitions\en-US."

 

Sure enough, if I look in C:\Windows\PolicyDefinitions I've got a 'WindowsUpdate.admx' with a few others.... but why?

 

Anyone want to chime in before I pull the trigger?

Edited May 28, 2021 by Koldov

[3s-gtech]

The 'local' PolicyDefinitions store is for local group policy, i.e. configuring them on the machine itself. While this works on a DC, to a point, it doesn't work properly if you have multiple DCs with a DFS-R sysvol for instance. You need to copy any policies to the \\yourdoman.com\SYSVOL\ yourdoman.com\Policies\PolicyDefinitions and that should be your baseline location for any ADMXs (and ADMLs).

[Oaktech]

You need to make yourself a 'central store' from the sounds of it...

 

https://docs.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store

[Koldov]

Sorry I have probably over explained.

 

Thanks, yeah I absolutely get that. We have 2 DCs, central store, replication, all that...

 

What I am having trouble with is where have my ADMX files gone? Some of my GPOs are behaving like they don't have ADMX files.

 

Looking in the 'Sysvol Policy Definitions' folder I have 103 files but I also have an 'OLD' folder that I put previous ADMX in a couple of years ago... that has 274 files in!

 

It appears to me that somehow ADMX files have just disappeared! Most of the 'Windows' ADMX files aren't there...

 

Here is a screenshot of SYSVOL\domain\policies\policy definitions (on the left is the current one and on the right is an old one) where are all the Windows ADMX files?

 

 

EDIT: The solutions I linked appear to resolve the issue by copying files from the local Windows\Policy Definitions into the central store (SYSVOL) to replace the missing ones there...

Edited May 28, 2021 by Koldov

[3s-gtech]

On a DC, it can kind of blend between both stores so a definition can be in either. As they’re only the definitions, of course it carries on working whether they’re defined or not. It may be that a setting or update has changed that, or have you changed DCs about?

[Koldov]

No I haven't changed anything on the DCs apart from Windows Updates (and recently installing Sophos).

 

I can't see all the missing ADMX files from the central store in the local store though, so I'm a bit confused as to where they've gone and why?

 

The ones that are missing as you can see in the screenshots are definitly the ones I'm having problems with.

 

Any GPO related to things like Windows Update (our WSUS for example), or Windows Firewall (SIMS exceptions and RDP) are now undefined in the GPO (whreas I know they were working fine because I created them and all the definitions where there for me to work with when I set them up).

Edited May 28, 2021 by Koldov

[Guest Guest]

From that screenshot it looks like the files are in the root of sysvol, they should be in the PolicyDefinitions folder

[Koldov]

Yes I can see that it might look that way, but I think that's because I've redacted the domain.

 

Honestly it's all in the right place, its all been working fine for years and it was obviously all ok a month or so ago when I last checked through the WSUS GPO.

 

EDIT: I'm going to check through the backups over the weekend and I'll restore the folder or reinstall the ADMX if I find that they should be in there and don't find any other good reason that they're not...

Edited May 28, 2021 by Koldov