Chapter 4 – Administrative Templates (ADMX/ADML)

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 4 – Administrative Templates (ADMX/ADML)

Learning Objectives

Understand ADMX and ADML files, the Central Store, registry-based policies, version management, custom templates, and troubleshooting.

1. What are Administrative Templates?

Administrative Templates are registry-based policy settings exposed in the Group Policy Management Console (GPMC). They allow administrators to configure thousands of Windows and Microsoft application settings without manually editing the registry.

2. ADMX vs ADML

ADMX files define policy settings in XML format. ADML files provide language-specific text displayed in GPMC. Example: Windows.admx with en-US\Windows.adml.

3. Location of ADMX Files

Local Store: C:\Windows\PolicyDefinitions
Central Store: \\domain\SYSVOL\domain\Policies\PolicyDefinitions
The Central Store ensures all administrators use the same template versions.

4. Central Store

Create the PolicyDefinitions folder inside SYSVOL and copy ADMX/ADML files from a supported Windows version. GPMC automatically uses the Central Store when it exists.

5. Registry-Based Policies

Most Administrative Templates write values to HKLM or HKCU under the Policies registry keys. This makes settings easy to audit and remove.

6. Supported Applications

Windows, Microsoft Edge, Microsoft Office, OneDrive, Google Chrome (with imported ADMX), Adobe Acrobat, Firefox (with enterprise templates), and many third-party products.

7. Importing Third-Party Templates

Download vendor ADMX files, copy ADMX to PolicyDefinitions and ADML to the appropriate language folder, then reopen GPMC to access the new policies.

8. Common Enterprise Policies

Windows Update, Microsoft Defender, BitLocker, OneDrive, Start Menu, Taskbar, File Explorer, Remote Desktop, PowerShell, Search, Control Panel, Microsoft Edge, Windows Hello for Business.

9. Creating Custom ADMX

Custom ADMX templates can expose organization-specific registry values as configurable GPO settings. Microsoft provides the ADMX schema for creating custom templates.

10. Troubleshooting

• Verify the Central Store path.
• Ensure ADMX and ADML versions match.
• Confirm language folders exist.
• Check permissions on SYSVOL.
• Review Event Viewer for Group Policy errors.
• Test with gpupdate /force.
• Verify registry values are written after policy refresh.

11. Useful Commands

gpupdate /force
gpresult /h report.html
Get-GPO -All
Get-ItemProperty HKLM:\Software\Policies
reg query HKCU\Software\Policies

12. Best Practices

Maintain one Central Store, update ADMX files after testing, keep backups before replacing templates, document imported vendor templates, and avoid mixing template versions from unsupported Windows releases.

13. Interview Questions

1. What is an ADMX file?
2. What is an ADML file?
3. What is the Central Store?
4. Where are ADMX files stored?
5. Why use a Central Store?
6. How do Administrative Templates affect the registry?
7. How do you import Chrome ADMX templates?
8. How do you troubleshoot missing Administrative Template settings?

14. Practical Lab

1. Create a Central Store.
2. Copy PolicyDefinitions from a Windows Server 2022/2025 machine.
3. Open GPMC and verify Central Store usage.
4. Import Microsoft Edge ADMX templates.
5. Configure Edge home page and update policy.
6. Run gpupdate /force and verify the registry.

Common Administrative Template Paths

Category

Example Policy

Path

Windows Update

Configure Automatic Updates

Computer Configuration > Administrative Templates > Windows Components > Windows Update

Defender

Turn off real-time protection

Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus

BitLocker

Require additional authentication

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption

Edge

Configure Home Page

Computer Configuration > Administrative Templates > Microsoft Edge

File Explorer

Hide drives

User Configuration > Administrative Templates > Windows Components > File Explorer

OneDrive

Prevent OneDrive usage

Computer Configuration > Administrative Templates > Windows Components > OneDrive

PowerShell

Turn on Module Logging

Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more