Management via GPO in an Active Directory Domain

As organizations upgrade their systems and deploy Windows 10 operating systems into their enterprise domain environments, it is important to also update group policies to manage new features. This article will introduce the topic of creating a Central Store to ensure the Administrative Templates required are available across all domain controllers for a consistent management experience.

Administrative Templates (.admx) and their accompanying language files (.adml) allow for system- and application-specific features to be controlled via group policy. Microsoft and other third-party companies (example: Google Chrome) have templates available for their products. The link below can be used for the April 2018 Update (1803) version of Windows 10. It’s important to use the templates corresponding to the edition of Windows 10 being deployed in the environment and note that some management features from previous versions/releases have also been deprecated.

https://www.microsoft.com/en-us/download/details.aspx?id=56880

The Central Store is a folder named PolicyDefinitions that is created within the SYSVOL folder on a domain controller. The template and language files are then stored in this folder where they are referenced and loaded in the Group Policy tools.

Create a folder named PolicyDefinitions in the following location:
\\domain.com\SYSVOL\domain.com\Policies
AMDX and ADML files that apply to a specific operating system release are included and can be found locally at this path:

C:\Windows\PolicyDefinitions

These files can be copied into the Central Store in the event of an issue obtaining the files from a Microsoft website or in an instance when features specific to the OS release are not included with a later ADMX template release.

Typically, template files are simply copied into the Central Store and older versions of the same file are re-written. Any files that are not included with the update stay in the Central Store and continue to function as designed.

In environments where workstations are upgraded frequently or have a variety of Windows Operating Systems deployed, it may be beneficial to create a copy of existing template files prior to installing new templates in case an issue occurs with managing features and there is a need to roll-back.

Getting Started:
There is a vast collection of new features to manage in Windows 10. Below is a link to Microsoft’s Group Policy settings reference guide.

https://www.microsoft.com/en-us/download/details.aspx?id=25250

The list below provides common settings to consider when deploying Windows 10 in an enterprise environment.

• Enable Windows Hello
  • https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-manage-in-organization
• Configure Microsoft Edge Browser
  • https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/index
• Disable Windows Store
  • https://docs.microsoft.com/en-us/windows/configuration/stop-employees-from-using-microsoft-store
• Configure Start Menu and Layout
  • https://docs.microsoft.com/en-us/windows/configuration/customize-windows-10-start-screens-by-using-group-policy

Written and composed by Raul Perez, Microsoft Systems Engineer