Score:1

How to Update ADMX Files - Different Server OS Versions in Domain

cn flag

My clients domain has various 2012R2, 2016 and 2019 Windows Server versions. Two of the four domain controllers are running Windows 2012R2 and the ADMX files haven't been updated in years. The other two domain controllers are Windows 2019 and they have the FSMO roles assigned to them.

I hope to have all 2012 instances retired for good shortly, including the DC's. Since the ADMX files haven't been updated in years I am unable to apply certain GPO's to the 2016 and 2019 instances which will become a security issue shortly. Since my environment will consist of 2016 and 2019 servers, what is the best policy or method I should use for updating the ADMX files?

From what I've read most people suggest the Central PolicyDefinitions Store option but I wasn't sure if this is a good idea since I'm running multiple OS versions in my environment. Are there any other approaches to updating the ADMX files I should consider considering the make up of my environment?

If I don't use the Central Store option, would I need to download the ADMX files to the C:\Windows\PolicyDefinitions folder locally on each domain controller in order to apply the latest settings to GPO's, or would I have to download ADMX file to C:\Windows\PolicyDefinitions on all domain members/servers in order for servers to receive updated gpo settings?

I've never had to update ADMX files so any advice would be greatly appreciated, thanks!

in flag
The GPOs are the same on all DCs, so why are you afraid to also have the same templates on all of them (in the newest version)?
jrd1989 avatar
cn flag
Hesitant because I don't have a dev or test environment to make changes in first, just prod. I take it your suggesting I setup the central policy definition store?
in flag
Yes, I have them in `C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions` and I also keep the previous version in a renamed directory.
Score:2
cn flag

There's a key thing to understand about Administrative Templates (ADMX):

Updating Administrative Templates will NOT change anything in the GPOs you deployed: ADMX are read by the Group Policy Management Console (or gpresult when you generate a report) to display the settings to a human (showing a list of settings, a description,...). That's it!


Example: consider the following scenario:

You create a new GPO with ADMX templates from 2011 and you deploy this GPO.
Now, imagine you update the ADMX templates to a newer version and let's say Microsoft removed from the newer ADMX files some of the older 2011-era settings you previously set with the older ADMX template files:
The computers/servers will not notice this, because they don't need ADMX to apply the policy.

However, the next time you'll open the Group Policy Management Console and want to edit your GPO, you'll NOT see the settings you set before, BUT they'll be shown under "Extra registry settings" (in the HTML report too)

So, worst case scenario for you: You'll end up with Group Policies deploying "older" settings that Microsoft removed from ADMX and you'll not be able to edit these settings using the Group Policy Console.

=> If you are using Central Store: Backup the current ADMX files, and update the ADMX templates. If needed, you can restore the older ADMX files.

=> If you are not using the Central Store: Note that editing a Group Policy from Server 2019 will use the Server 2019 ADMX files (local), so, if you configured "older" settings that Microsoft removed with Server 2019, they'll show up as "Extra Registry Settings" when viewed from a 2019 server because the policy editor doesn't know how to show you these settings. Opening the Group Policy Console from Server 2012R2 will use the 2012R2 ADMX files (local). (By the way, that's why the Central Store is recommended because you don't want to see different behaviors in the GPO consoles based on "where" you are editing the policies...)

You can take a look at my answer here too, about a similar situation.

jrd1989 avatar
cn flag
Thank you for this explanation, it helped clear up some of my confusions. What is the difference between C:\Windows\SYSVOL\domain\Policies and C:\Windows\PolicyDefinitions? My domain controllers don't have a 'PolicyDefinitions' folder in the C:\Windows\SYSVOL\domain\Policies path. The 'Policies' folder only contains the GPO folders and their configs. The admx files are stored in C:\Windows\PolicyDefinitions on each DC.
Swisstone avatar
cn flag
@jrd1989 You have to create PolicyDefinitions yourself in SYSVOL\domain\Policies, take a look at the documentation: [Create and Manage the Central Store](https://docs.microsoft.com/en-US/troubleshoot/windows-client/group-policy/create-and-manage-central-store), c:\windows\policydefinitions is the local path when you do not use the Central Store
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.