To manage users and computers, you need to
configure the administrative template policies. These policies provide
easy access to registry-based policy settings that control the operating
system, Windows components, and programs. Although earlier versions of
Windows that support Group
Policy use administrative template (ADM) files with a proprietary
markup language to store registry-based policy settings, Windows 8 uses a
standards-based XML file format called ADMX. Unlike ADM files, which
are stored in the GPO to which they relate, ADMX files are stored in a
central repository. In domains, central storage of ADMX files makes it
easier to work with and manage the files.
Viewing Policies and Templates
As shown in Figure 1, you can view the currently configured templates in the Group Policy Management Editor’s Administrative
Templates node, which contains policies that can be configured for
local systems, OUs, domains, and sites. Different sets of templates are
found under Computer Configuration and User
Configuration. You can add templates containing new policies manually
through the Group Policy Management Console and when you install new
Windows components.
Any changes you make to policies available through the administrative
templates are saved in the registry. Computer configurations are saved
in HKEY_LOCAL_MACHINE, and user configurations are saved in HKEY_USER.
Browsing the Administrative Templates node in the Group Policy
Management Editor is the best way to become familiar with available
administrative template policies. As you browse the templates, you’ll
find that policies are in one of three states:
-
Not Configured The policy isn’t used, and its settings do not impact the existing configuration on the computer.
-
Enabled The policy is active, and its settings are saved in the registry.
-
Disabled The
enabled behavior of the policy is not on. The policy may have a specific
disabled behavior that is contrary to its enabled setting. This setting
is saved in the registry.
Enabling, Disabling, and Configuring Policies
In the Group Policy Management Editor, you’ll find administrative
templates in two nodes: Computer Configuration and User Configuration.
In most cases, the policies in these areas don’t overlap or conflict
with each other. If there is a conflict, however, computer policies have
precedence, which means that the computer policy is enforced. Later in
this chapter, you’ll find details on commonly used policies and how to employ them.
Before you can work with policies, you must access the Group Policy
Management Editor for the site, domain, or OU you want to work with. To
access a GPO for a domain or OU, follow these steps:
-
In the GPMC, expand the entry for the forest you want to work with, and then expand the related Domains node.
-
Expand the node for the domain you want to work with, and then expand the related Group Policy Objects node.
-
Press and hold or right-click the GPO that you want to work with, and
then select Edit. This opens the GPO for editing in the Group Policy
Management Editor.
Once you’ve opened a GPO in the Group Policy Management Editor, you
can enable, disable, and configure policies by completing the following
steps:
-
Under the Computer Configuration or User Configuration node (whichever applies to the type of policy you want to set), access the Administrative Templates folder.
-
In the left pane, tap or click the subfolder containing the policies
you want to work with. The related policies are displayed in the right
pane.
-
Double-tap or double-click a policy (or press and hold or right-click
a policy and select Properties) to display its Properties dialog box.
-
Tap or click the Explain tab to see a description of the policy, if one is provided.
-
To set the policy’s state, tap or click the Setting tab, and then use the following options to change the state of the policy:
-
Not Configured The policy is not configured.
-
Enabled The policy is enabled.
-
Disabled The policy is disabled.
-
If you enable the policy, set any additional parameters specified on the Setting tab, and then tap or click Apply.
-
Use the Previous Setting or Next Setting button to manage other
policies in the current folder. Configure them as described in steps
4–6.
-
Tap or click OK when you have finished managing policies.
Adding or Removing Templates
You can add or remove template folders in the Group Policy Management Editor. To do this, complete the following steps:
-
Access the Group Policy Management Editor for the site, domain, or OU you want to work with.
-
In the Computer Configuration or User Configuration node, press and
hold or right-click the Administrative Templates folder, and then tap or
click Add/Remove Templates. This displays the Add/Remove Templates
dialog box.
-
To add a template, tap or click Add. Then, in the Policy Templates
dialog box, select the template you want to add, and then tap or click
Open.
-
To remove a template, select the template, and then tap or click Remove.
-
When you have finished adding and removing templates, tap or click Close.
