Extending Group Policy

To add your new template, right-click the Administrative Templates node under either Computer Configuration or User Configuration and choose Add/Remove Templates. When you click Add, you should see a list of available .adm files. Select your new custom template and click Open. Close Add/Remove Templates and you should see new categories made available through your custom template in the Group Policy Editor snap-in. However, you might be frustrated to see that the individual settings aren't visible. Fear not, the folks at Microsoft are just trying to protect you from messing up your registry. You'll find the secret to viewing your newly created preference settings in the Group Policy Editor snap-in's Filtering dialog box. Select View, Filtering to open the dialog box, which Figure 2 shows, and uncheck the Only show policy settings that can be fully managed check box.

Of course, you should test the behavior of any Group Policy settings before you deploy them, but I encourage you to be even more stringent in your testing of settings made through custom Administrative Templates. Make sure that you understand which keys the settings alter and how they affect the application in different situations. For example, test what happens when an application user changes the settings a template has altered and what happens to the settings when a user logs off, when the system is rebooted, and when the GPO is altered or removed. The last thing you want to do is deploy a setting that cripples an application for your users and then be unable to undo that setting.

After you've verified that a GPO template lets you manage an application successfully with no side effects, you can use the template to modify a domain GPO. The process is similar to that described here except that instead of accepting the default Local Computer selection (as I advised in the first paragraph of this section), click Browse. You can then browse your domain to select the GPO that you want to edit.

When Confused, Break It Down
I've thrown a lot of components and keywords at you in a short amount of space, and you might feel a bit overwhelmed. The best advice I can give you is to start simply. Break down the application and its interface to determine the settings you want to change and add the changes one GPO at a time to your template. Don't start a new GPO until the prior one is behaving as expected. You can use a registry-monitoring tool such as Regmon (freeware from Sysinternals) to find the keys and values that you want to alter.

Group Policy is one of several ways that you can manage Windows and some Windows applications. If you're already using Group Policy to manage your client systems, you might find that leveraging custom Administrative Templates to manage formerly unmanaged applications is an effective use of this technology.