How do you update your Group Policy ADMX files?

Posted by

Every now and then Microsoft releases a new operating system and if you are in a domain environment you should be interested in manage your new (and old) computer via Group Polices. To manage your computer you need either the target operating system version (or later) with RSAT (Remote Server Administrative Tools) or equivalent server operating system to be able to see and configure all features. You also need updated Group Policy settings files, Group Policy Administrative Templates or simply updated ADMX files for the new operating system. You can get these ADMX files in different ways either download them from Microsoft Download pages: Administrative Templates (.admx) for Windows 10 or in the folder “%WinDir%\PolicyDefinitions” from the operating system you want to manage, make sure it is fully updated with all service packs, patches etc.

If you install RSAT on the target computer and manage Group Policies from there you are fine, no need to change any thing, but if you want to manage the Group Policies from a server that are not the latest and maybe not the same templates, you need to do one of two things.

  • Update “%WinDir%\PolicyDefinitions” with the latest templates (replace the existing). Note! The downside of doing this is if you have more than one server you are managing group policies from you need to update all of them
  • Update central store for Group Policy Administrative Templates. This is a preferred way in this case the domain controllers will replicate the templates and makes sure you have the latest templates available where ever you are without any local changes. Microsoft just updated the KB how to do this and it is really simple so just go and do it
    How to create and manage the Central Store for Group Policy Administrative Templates in Windows

Note! When you are done it should look like this in your \\<domain>\SysVol\<Domain>\Policies folder.

If you have trouble with permissions you could update the local Sysvol folder on a Domain controller: %WinDir%\SYSVOL\sysvol\[<Domain>\Policies. (You may need to modify the permissions, since default is only SYSTEM has full control)

image

Also note the problem descibed in the next post about WindowsLocationProvider

 

Did I miss anything, or do you have any problems updating the templates. Let me know in the comments

7 comments

  1. Hi Mattias,
    I added new admx files in the c:\windows\policy definitions on my test DC, after I checked to make sure they included the ‘sharedcomputerlicensing’. I have been viewing it from my Local computer policy and I can’t see where the options have changed and no ‘sharedcomputerlicensing’ option in the office\updates? what step did I miss? There is only one DC in my test lab. I’ve tried removinging and adding it back to my console, refreshing, nothing seems to be changing it? Suggestions?

    Like

  2. Hi,

    When updating AMDX from windows 7 to windows 10. Is there anything that needs to be configured before applying and upgrade?

    Like

  3. Hi Thomas, no you are not forced to set all the settings again when you change the ADMX/Policy templates files. These are only files for all available settings, the settings are stored in other places.
    Eventually the setting you have set have been moved, therefor you may see Not Configured. Check a few more settings and you will see they are all there.
    Good luck

    Like

  4. I replaced an ADMX file with a newer one (same name, just newer version), and everything added smoothly. The settings tab says the settings are there, but when I look in the new admin template with “Edit”, the settings say “not configured”. Do I have to go back through every policy that was using that template, and reapply the settings?

    Like

Leave a comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.