Group Policy - Administrative Templates

This article was also published as part of the Microsoft TechNet Flash newsletter under the title Group Policy Administrative Templates in Windows Server 2008.

Administrative Templates (AT) Files

Administrative Templates files (we have ADM and ADMX linked to ADML, when I speak in general, I will say ADM/ADMX files) contain templates that allow you to configure a property by changing the registry. When I create a Group Policy Object (GPO, simply a policy) using the Group Policy Object Editor (GPOE) or the Group Policy Management Console, i.e. the Group Policy Management Editor (GPME), the ADM/ADMX files are loaded and certain items are displayed in the editor. When I change an item, it is stored inside the policy in the registry.pol file. This is then applied to the computers/users. Templates are only needed for creating the policy, but not for the actual application on the client.

The basic ADM/ADMX files are distributed along with the operating system. ADM/ADMX files contain not only settings for the current OS, but for all platforms supported at the time (which means that on Windows XP we also have information for server or older OSes). Also, the new default ADMX files contain everything that was in the standard ADM files.

On the internet, we can download various additional ADM/ADMX files, for example for MS Office. Or even those ADM/ADMX files that are part of different versions of Windows. It's also no problem to create our own ADM/ADMX file with some setting.

ADM File

The original file format for templates from Windows 2000 to 2003/XP. It is a text file that is language-dependent (we have a new file of the same name for each language, so policy configuration can only be done in one language). ADM files can be used in newer OS versions (Windows 7) as well, but the standard files distributed with the OS are now only ADMX and these files take precedence over ADM.

If we use ADM files when creating a policy, these files are saved in the created policy (in the Sysvol directory in the domain). So the policy has a size of several MB instead of a few kB.

ADMX File

This is a replacement for ADM files, which came with Windows Vista and Windows Server 2008. ADMX is an XML-formatted file that is language-neutral. We need a corresponding ADML file for a certain ADMX file. This supports multilingualism (multiple administrators can edit one policy, each in a different language). ADMX/ADML files are also not saved in the policy itself, so it is significantly smaller. Optionally, we can use the Central Store (more later).

ADML File

A supplement to the ADMX file, which contains language-specific information (policy text in a specific language). Subdirectories for specific languages (such as en-US, cs-CZ or de-DE) are created in the folder with the ADMX files, and the ADML files with the same name as the ADMX are stored in them.

Loading ADM/ADMX Files

ADMX Files

In the administrative tools (GPOE, GPME), ADMX files are automatically searched for in two paths. In the Central Store, a network repository in the domain, whose address is \\FQDN\SYSVOL\FQDN\policies\PolicyDefinitions. If not found here, it is searched in the local repository at c:\Windows\PolicyDefinitions. If the Central Store exists and is accessible, the local files are not used.

Creating a Central Store

To create a Central Store, we just need to create the specified directory on one domain controller (it will be replicated to the others) and copy the ADMX and ADML files into it, for example from Windows Server 2008 R2. We always need to keep the latest version of these files, so that it contains all the settings (for example after installing a Service Pack). Currently the latest version is for Windows Server 2008 R2/Windows 7.

ADM Files

On the other hand, ADM files are normally (if we have them in the system) stored in c:\Windows\inf. When creating a policy (in Windows where ADMX are not yet available), some default ones are loaded and we can manually add or remove them. We right-click on Administrative Templates in the editor and choose Add/Remove Templates. The default ADM files are conf.adm, inetres.adm, system.adm, wmplayer.adm, wuau.adm. These 5 files together take almost 4 MB and are inserted into each created policy.

If we use a system with ADMX files, we can still add ADM files, they will be displayed under the Classic Administrative Templates (ADM) group.

Saving the GPO

Policies (GPO) in the domain are stored (on the domain controllers) in the path \\FQDN\SYSVOL\FQDN\policies. There is a directory for each policy, named {GPO GUID} (the policy ID in brackets). If it is a policy created using an ADM file, there is a subdirectory Adm here, which contains all the ADM files that were added during creation. So we can copy them from here if we need them. But it is certainly more efficient to use the new ADMX files stored in the Central Store (individual policies are then much smaller), which means creating and managing policies in newer Windows versions.

Converting a Policy with ADM Files to a New One

As we said, it's better to create new policies in newer OS versions (like Windows 7) and manage them there (we wouldn't see new items in older OSes and ADM files would be added directly to the GPO).

We can edit old policies in new OSes, but this doesn't remove the ADM files (although if they're not special, we wouldn't use them anyway - if there's a matching ADMX, that one is used).

A clean solution to get rid of ADM files is to recreate the GPO. The temptation would be to import settings from the old policy into the new one, but unfortunately the import also inserts the ADM files. Still, the import option can sometimes be useful, as it copies the settings (and only that, not permissions, delegation, etc.) from the backed up policy. We can perform the backup as one step of the wizard. We import it using the Group Policy Management Console, navigate to Group Policy Objects and right-click on the policy into which we want to import the settings. From the menu, choose Import Settings and go through the wizard.

Note: We can back up all policies by right-clicking on Group Policy Objects in the Group Policy Management Console and choosing Back Up All.

One way to remove ADM files from a GPO is to open the policy in the new OS. Right-click on Administrative Templates and choose Add/Remove Templates and remove all attached files. When we then look in the policy directory, the Adm directory is empty. And when we look at the policy, for example in the Group Policy Management Console, we see that the settings remain.

Converting an ADM File to ADMX

To convert old ADM templates to new ADMX, we can use the ADMX Migrator tool. We can also use it to edit an ADMX file or create a new one.

Searching in Administrative Templates

In the past, it was always a big problem to find anything in policy settings. There are several thousand items here and there was no basic search functionality. Fortunately, we now have two helpful operations available, displaying all items in one place and filtering.

All Settings

New in the administrative tools for editing GPOs (GPOE, GPME), under the Administrative Templates item, there is a All Settings folder that contains all the settings from all the loaded ADM/ADMX files. So we can search for items by name.

Filtering Administrative Templates

Another new feature of the editing tools is the ability to filter settings from ADMX files. When we right-click on Administrative Templates or a subfolder, we have Filter On and Filter Options available in the context menu.

When we choose Filter Options, a dialog is displayed where we can enter filtering parameters. We can list items that are configured, that have a comment, that are intended for a particular platform (Requirements Filters). And probably the main one is filtering by keywords (Keyword Filters), where we enter one or more words and specify their occurrence in the policy name, description or comment. After clicking OK, the filtering is immediately activated (Filter On).

Note: If you enter a keyword and don't get any results, it may be due to a bug in the MS tool. You need to switch the keyboard to English and re-enter the filtering parameters (Filter Options).

Links

• Group Policy description by MS
• Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7
• Administrative Templates (ADMX) for Windows Server 2008