Help using ADM templates in GPO

ajf

ajf

ajf

Soldato
Joined
30 Oct 2006
Posts
3,053
Location
Worcestershire, UK
I am setting up some new GPOs on the network.
One of the things I wanted to do was set some settings in IE11.
Apparently this needs an add on ADM template before I can do it.

I have downloaded the ADM file but cannot find any clear instructions on how to use it.
I am editing the GPOs on my Windows 7 laptop using the server admin tools that are installed.
 
don't edit your default domain or domian controller policies! Create new from scratch

also ADM is old, admx and adml is the new standard of file types if you're struggling to find them

http://msdn.microsoft.com/en-us/library/bb530196.aspx


To create the central store
Create the root folder for the central store %systemroot%\sysvol\domain\policies\PolicyDefinitions on your domain controller.
Create a subfolder of %systemroot%\sysvol\domain\policies\PolicyDefinitions for each language your Group Policy administrators will use.
Note Each subfolder is named after the appropriate ISO-style Language/Culture Name. For a list of ISO-style Language/Culture Names, see Valid Locale Identifiers. For example, to create a subfolder for U.S. English, create the subfolder: %systemroot%\sysvol\domain\policies\PolicyDefinitions\EN-US
Populate the Central Store with ADMX Files
There is no user interface for populating the central store in Windows Vista. The procedure shows how to populate the central store using command line syntax from the Domain Controller.
To populate the central store
Open a command window: click Start, click Run, then type cmd.
To copy all the language-neutral ADMX files from your Windows Vista administrative workstation to the central store on your domain controller using the xcopy command, type:
xcopy %systemroot%\PolicyDefinitions\* %logonserver%\sysvol\%userdnsdomain%\policies\PolicyDefinitions\
To copy all ADMX language resource files from your Windows Vista administrative workstation to the central store on your domain controller using the xcopy command, type:
xcopy %systemroot%\PolicyDefinitions\EN-US\* %logonserver%\sysvol\%userdnsdomain%\policies\PolicyDefinitions\EN-US\
Edit the Administrative Template Policy Settings in the Domain-Based GPOs
You can edit GPOs only using ADMX files on a Windows Vista-based computer.
To edit administrative template policy settings using ADMX files
To open the Group Policy Management Console on a Windows Vista machine, click Start, click Run, then type GPMC.msc.
To create a new GPO to edit, right-click the Group Policy objects node and select New.
Type a name for the GPO and click OK.
Expand the Group Policy objects node.
Right-click the name of the GPO you created and click Edit.
The Group Policy Object Editor automatically reads all ADMX files stored in the central store. When there is no central store, the Group Policy Object Editor reads the local versions of the ADMX files used by the local GPO on your Windows Vista administrative machine.
Note You can still remove and add ADM files to the GPO. There is no user interface for adding or removing ADMX files in Windows Vista.
To add local ADMX files to the Group Policy editing session, copy the ADMX files to the %systemroot%\PolicyDefinitions\ folder and restart the Group Policy Object Editor.
 
Thank you for that.
I will walk myself through that and see how I get on.

Don't worry, I've already created a copy of one of our existing GPOs which I am editing and using for testing. We have several which I am condensing into one and also updating for Windows 7 machines rather than our old XP boxes which are being replaced.
 
that maybe where you're having issues, I have had old gpo's refuse to accept new ADM/X/L templates so it was easier to just create a new one

edit*

Try not to have few GPO's doing too much and label them to what they do. I split 99% of GPO's into with User or Computer and apply them to relevant OUs and disable the un needed part bringing a speed increase at start-up.

e.g.

"User - IE" : IE settigns related to User
"User - Security" : Security settings such as password policy, temp file cleaning
"User - Office" : Policy for the Office applications such as default fonts and size
"Computer - Offline Files" : policy forcing paths and latency

With that sort of structure I find it easier to troubleshoot issues relating to GPO's
 
Last edited:
Not sure if you can help me on another related issue.
Found the admx files for IE11 and have copied them into the folder structure as shown in your original post.
When I open up Group Policy Management (on server or my laptop) it shows the options under Administrative Templates -all good.
However a number of things I want to do require setting a new option under User Configuration - Preferences -Internet Settings.
This site shows what I mean:
http://www.blackforce.co.uk/2013/12...ge-proxy-settings-in-group-policy-preferences

When I try this I still only get options up to IE8.

Any ideas what I am missing?
 
I just copy the admx files to

\\anydc\SYSVOL\fqdn\Policies\PolicyDefinitions\

Copy the relevant EN-US files in to the en-us folder and put the admx files with the rest of them.


If you right click on administrative templates within a group policy. Then goto add remove templates, you may need to add in the new inetres and remove the old one, but shouldn't realy have to do that. ahh you probably missing this, i also have not installed that ie 10 admx yet.

http://www.microsoft.com/en-us/download/details.aspx?id=37009

Windows Server 2008 R2 SP1:

If you install Internet Explorer 10, the Administrative Template files (interes.admx and inetres.adml) will be installed automatically.

If you upgrade ie to 10 on the DC 2008 r2 sp1 dc it adds it automatically.
 
Last edited:
I already have an admx and adml file for IE11 which I imported.
The IE 10 seems to be an adm file and if added to the templates manually just does the same as the IE 11 admx files.
I still cannot add an IE 10 setting to the internet settings as my links shows should happen.
Does the functional level of the domain have any impact here?
 
I think what you are looking for is dependent on Server 2012 Domain Controller at the 2012 functional level (probably only the 2012 dc that is required not functional level.)

under step 4 and 5 of your link, i also only have ie8 on the list, even though i have updated to ie10 admx and manually replaced the inetres file with the newer version.

But if i go to adminstrative templates, windows components, internet explorer. That section is now fully updated to ie 10 level.

the inetres template should have a recent date

fINrojql.png.jpg

You may want to try updating ie on the DC to 10 or 11 and reboot the dc and see if that adds the options.
 
Last edited:
Hello

Installing the administrative templates will not help with the Preferances settings. To enable the list in Internet Explorer Preferences you need to make the changes from a Windows 8 (with the lasted admin tools installed) or Windows 2012 servers with group policy management installed.

When editing Internet Explorer preferences from either Windows 8 or Windows 2012 you will see the options for internet explorer 10 and 11.

Thanks
 
You must log in or register to reply here.
Back
Top Bottom