Managing Windows Vista Group Policy Options

I've started to deploy Windows Vista machines but can't find the Administrative (ADM) template files to manage the new Vista Group Policy options. Where are they? With Vista and Longhorn Server, Microsoft has added many new categories of functionality to Group Policy, including Power Management, which, in earlier Windows versions, wasn't configurable via Group Policy without third-party add-ons; drive-blocking capabilities, which let administrators restrict the USB-type devices that can be used on computers; better Microsoft Internet Explorer (IE) settings management; and improved printer support, including the ability to delegate users the capability to install their own printer drivers, removing the need for users to be local administrators of their machines. To facilitate management of these new categories of functionality and improved manageability in general, Microsoft created a new administrative template format, ADMX, which is a standards-based, XML file format. Instead of the standard seven ADM files available with Windows XP, Vista has 132 ADMX files, which provide an XML-based structure for defining the display of the Administrative Template policy settings in the Group Policy tools. You'll find them by default in the C:\Windows\PolicyDefinitions folder.

Windows Server 2003, Windows 2000, and XP Group Policy management tools, including Group Policy Management Console (GPMC) and Group Policy Editor (GPE), understand only ADM files, so it's logical to search for the updated ADM files for the new Vista Group Policy settings, but you won't find them. For Vista, Microsoft has taken the approach of managing Vista from Vista, which means you need to edit Group Policy Objects (GPOs) that apply to Vista machines from a Vista machine (or Longhorn when it's released).

Vista includes GPMC as part of the core product. Simply start the Microsoft Management Console (MMC), and add the Group Policy Management snap-in. GPMC shows the machine's local forest Group Policy information and lists all GPOs, which you can then edit.

You can manage Group Policy for pre-Vista machines from a Vista machine because the ADMX files that ship with Vista are a superset of the ADM files in pre-Vista versions. Any settings available in the legacy ADM files are available in the new ADMX templates. If you attempt to view a GPO that has Vista settings from a pre-Vista GPMC session, the Vistaspecific configurations will show in the Extra Registry Settings section under Administrative Templates.

Therefore, the way forward is to upgrade all Group Policy administrators' workstations to Vista before upgrading any other machines. That way, administrators can start configuring the necessary Group Policy settings prior to a large-scale rollout.