Adding New Administrative Templates to a GPO

In a previous article - Understanding Administrative Templates in GPO - I've described the purpose of the Administrative Templates section in the Windows 2000/XP/2003 GPO. Administrative Templates are a large repository of registry-based changes that can be found in any GPO on Windows 2000, Windows XP, and Windows Server 2003. The Administrative Templates are Unicode-formatted text files with the extension .ADM and are used to create the Administrative Templates portion of the user interface for the GPO Editor.

Although Administrative Templates have virtually hundreds of options within them, there may be times when an administrator will need to add more options to a new or existing GPO.

One method for an administrator to add such extensions to the GPO is by adding new settings to the Administrative Templates sections. This can be done by adding .ADM files to the existing Administrative Templates section in GPO.

Adding .ADM files to the Administrative Templates in a GPO

In order to add additional .ADM files to the existing Administrative Templates section in GPO please follow the next steps:

1. Open the Group Policy Management Console (or GPMC) from the Administrative Tools folder in the Stat menu, or by typing gpmc.msc in the Run command.

Note: GPMC is not a built-in part of Windows 2000/XP/2003, and needs to be separately installed. You can download GPMC from the following link (Download GPMC), yet remember it can only be used effectively on Windows Server 2003-based Active Directory.

If you do not have GPMC or cannot install it then you'll need to edit the GPO via the regular means, i.e. from Active Directory Users and Computers management tool (dsa.msc).

1. Right-click an existing GPO (or create an new GPO, then right-click on it) and select Edit.

1. Expand either the Computer settings or Users settings sections of the GPO. Go to the appropriate Administrative Templates section and right-click it. Select Add/Remove Templates.

1. In the Add/Remove Templates window click Add.

1. Browse to the location of the required .ADM file and click Open.

1. In the Add/Remove Templates window notice that the new .ADM file is listed, then click Close.

Now re-open the Administrative Templates section and browse to the new settings location.

Disabling GPO settings filtering

Many custom Administrative Templates require you to remove the requirement to show policy settings that can be fully managed in the GPO editor. To do so follow the next steps:

1. After completing the above procedure, browse to the newly added Administrative Template section.

Note that the section is indeed listed, however in the right-pane is empty.

1. Right-click an empty spot in the right pane and select View > Filtering.

1. In the Filtering window click to un-mark the "Only show policy settings that can be fully managed" option. Then click Ok.

1. Notice how the available options are now displayed in the right pane.

Replicating the added .ADM files across the domain

When adding new .ADM files to any GPO you actually place new features in the Administrative Templates section for that GPO. These settings should be accessible from any DC, and should apply to any computer that is affected by that GPO.

However, if the .ADM files were added, for example, when sitting on DC1, how do you make sure they are also replicated to DC2, DC3 and so on?

Well, luckily for us, in most cases there are no additional configuration steps involved. When adding the new .ADM file it is automatically uploaded to the following location on the DC that was used to edit the GPO (usually - the PDC Emulator, read more in the Understanding FSMO Roles in Active Directory article):

%SystemRoot%\SYSVOL\sysvol\domain name\Policies\{GPO GUID}\Adm

as seen clearly in the following screenshot:

Because all of the SYSVOL folder is shared and automatically replicated all over the domain, the uploaded .ADM file will automatically replicated to all the GPO instances on all DCs in the domain.

However this might cause a problem when using too many templates and too many GPOs, especially on slow WAN links.

In Windows Server 2003, the size of the Administrative Templates has grown when compared to the same .ADM files in Windows 2000. As a result, the entire set of Administrative Templates has grown to almost 1.75MB. When you multiply this size by each Policy that SYSVOL contains, you can see that much space is devoted to these templates.

For example, for a large corporation with 1200 GPOs in place, the entire SYSVOL folder (where the GPOs are located on each DC) can take up more than 1GB of hard disk space. Replicating such a folder over the WAN (especially when promoting a new DC) can be very problematic. Here is where the following article - Install DC from Media in Windows Server 2003 - comes in very handy.

Removing .ADM files from an existing GPO

Whenever you do not need the added feature anymore you can simply reverse the process and instead of adding new .ADM files - removing them.

Before removing an Administrative Template, make sure you modify its policy settings and wait for Group Policy to refresh on all the computers that were supposed to be effected by the GPO. This is because removing an Administrative Template that was previously installed does not change or remove any Registry settings that the GPO deployed when Group Policy was last processed.

You should also read KB 813338 for more info on removing .ADM files from GPOs.

Links

Create Custom Administrative Templates in Windows 2000 - 323639

Group Policy Template Behavior in Windows Server 2003 - 316977

How to minimize SYSVOL size by removing administrative templates (.adm files) - 813338