Managing Windows Vista Group Policy Options

I've started to deploy Windows Vista machines but can't find the Administrative (ADM) template files to manage the new Vista Group Policy options. Where are they? With Vista and Longhorn Server, Microsoft has added many new categories of functionality to Group Policy, including Power Management, which, in earlier Windows versions, wasn't configurable via Group Policy without third-party add-ons; drive-blocking capabilities, which let administrators restrict the USB-type devices that can be used on computers; better Microsoft Internet Explorer (IE) settings management; and improved printer support, including the ability to delegate users the capability to install their own printer drivers, removing the need for users to be local administrators of their machines. To facilitate management of these new categories of functionality and improved manageability in general, Microsoft created a new administrative template format, ADMX, which is a standards-based, XML file format. Instead of the standard seven ADM files available with Windows XP, Vista has 132 ADMX files, which provide an XML-based structure for defining the display of the Administrative Template policy settings in the Group Policy tools. You'll find them by default in the C:\Windows\PolicyDefinitions folder.

Windows Server 2003, Windows 2000, and XP Group Policy management tools, including Group Policy Management Console (GPMC) and Group Policy Editor (GPE), understand only ADM files, so it's logical to search for the updated ADM files for the new Vista Group Policy settings, but you won't find them. For Vista, Microsoft has taken the approach of managing Vista from Vista, which means you need to edit Group Policy Objects (GPOs) that apply to Vista machines from a Vista machine (or Longhorn when it's released).

Vista includes GPMC as part of the core product. Simply start the Microsoft Management Console (MMC), and add the Group Policy Management snap-in. GPMC shows the machine's local forest Group Policy information and lists all GPOs, which you can then edit.

You can manage Group Policy for pre-Vista machines from a Vista machine because the ADMX files that ship with Vista are a superset of the ADM files in pre-Vista versions. Any settings available in the legacy ADM files are available in the new ADMX templates. If you attempt to view a GPO that has Vista settings from a pre-Vista GPMC session, the Vistaspecific configurations will show in the Extra Registry Settings section under Administrative Templates.

Therefore, the way forward is to upgrade all Group Policy administrators' workstations to Vista before upgrading any other machines. That way, administrators can start configuring the necessary Group Policy settings prior to a large-scale rollout.

Please or Register to post comments.

IT/Dev Connections

Las Vegas
September 30th - October 4th

Paul ThurottYou'll have the opportunity to experience:
• The Microsoft
Technology Roadmap
• Office 365 Implementation
• Hyper-V Optimizing
• Windows 8 Deployment
and much more!

Come See Paul Thurrott & Rod Trent in Person!

Early Registration Now Open

Upcoming Training

Mastering SharePoint 2013: Succeeding, Not Just Surviving

Building on the success of the “Mastering SharePoint 2010” seminars, the presenters have updated the content to cover the latest and greatest SharePoint product: SharePoint 2013. While SharePoint 2013 is relatively new on the marketplace, the presenters have been working with SharePoint 2013 for well over a year, and have implemented it with a number of clients in production environments.

Register Now

Current Issue

May 2013 - The NameTranslate object is useful when you need to translate Active Directory object names between different formats, but it's awkward to use from PowerShell. Here's a PowerShell script that eliminates the awkwardness.

CURRENT ISSUE / ARCHIVE / SUBSCRIBE

Windows Forums

Get answers to questions, share tips, and engage with the Windows Community in our Forums.