Group Policy Central Store

Can anyone give me a best information about group policy central store? why we config central store for group policy? what is the advantage from configuring central store for group policy?
Regards,
Ashane Deshapriya ( MCP )

For questions about Group Policy, the dedicated GP forum is probably best:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverGP
Some helpful information about CS (and, how templates work when you don't use CS):
http://support2.microsoft.com/kb/929841
http://technet.microsoft.com/en-us/library/cc709647(WS.10).aspx
http://ad.kazakinfo.com/2011/04/central-store-for-admx-templates/
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Similar Messages

Upgrade Group Policy Central Store

Hi everyone,
Currently I have a windows server 2008 R2 domain environment with windows 7 client computers, the policy definitions are stored in the Central Store.
I have a very simple question but I can't find the answer..
I want to test the windows 8.1 group policy definitions but can I just overwrite the current windows 7 definitions with the new windows 8.1 definitions
without destroying the current group policy's ??
Thnx,
Pouyan

The Central Store basically lets your GPMC see what settings you can configure. Here is a guide on updating the central store plus links to another ADMX templates you might want to include.
http://deployhappiness.com/creating-the-group-policy-central-store-updated-for-windows-8-12012r2/
If my answer helped you, check out my blog:
DeployHappiness. Subscribe by
RSS or
email.

Advice on creating a central store

Hi, just after a bit of guidance.
I want to make Office 2013 templates available to all administrators using GPMC.
I have read about creating a central store for administrative templates.
However some of the guides I have found say: " Every policy that you create will automatically include this ADM folder" -
http://deployhappiness.com/creating-the-group-policy-central-store-updated-for-windows-8-12012r2/
But my policy folders don't all have an ADM folder, does this mean there is something wrong with my sysvol/FQDN/Policies folder?
I also heard that when creating a central store it will delete my existing templates, I have found a download for Win 8.1/Server 2012 templates here:
http://www.microsoft.com/en-US/download/details.aspx?id=41193
But will that be all the templates for XP/7 etc or just strictly Win8/2012?
Basically I want to create a central store with EVERYTHING in it, so I don't lose any policies and I have all templates saved as well as the ability to add new templates for things like Office in the future.

Hi,
Thanks for posting in the forum.
Regarding your request, you’d better refer to the following official article to implement the Central Store.
How to create the Central Store for Group Policy Administrative Template files in Windows Vista
http://support.microsoft.com/kb/929841
How to Implement the Central Store for Group Policy Admin Templates, Completely (Hint: Remove Those .ADM files!)
http://blogs.technet.com/b/askpfeplat/archive/2011/12/12/how-to-implement-the-central-store-for-group-policy-admin-templates-completely-hint-remove-those-adm-files.aspx
Here is another article as reference, it may be useful too.
Creating a Group Policy Central Store
http://www.petri.co.il/creating-group-policy-central-store.htm#
Since some settings have changed on the latest Windows OS, if you want to keep the settings, you’d better keep the template file for older OS.
Hope this helps.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Andy Qi
TechNet Community Support

How to control IE10's "Compatibility View settings" via Group Policy

First
of all thanks for taking the time to read this. I must let you know that I have limited experience with Group Policy so here it goes...
Domain Controllers are 2008 R2 Datacenter and client computers are Win7 Pro with IE10
I need to add several sites to the "Compatibility View settings" in IE10 and have these pushed out via Group Policy.
I followed this to enable the "Use Policy List of Internet Explorer 7 sites:"
Use
Policy List of Internet Explorer 7 sites
I even added the settings to both User Configuration as well as Computer Configuration. However the computers on the domain wouldn't show these sites in
IE even after forcing a GP update (gpupdate /force)
Yes I did use top level domain names.
Next I installed the Administrative Templates for Windows Internet Explorer 10 on the DC:
Administrative Templates for Windows Internet Explorer 10
this gave me an Inetres.adm file while I put in the same location as my other .adm files that Group Policy Manager sees (located at C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Adm)
I do see a bunch of .ADMX files located at C:\Windows\PolicyDefinitions
on the DC. I also see a lot of .ADML files located at C:\Windows\PolicyDefinitions\en-US.
Where is my Central Store located that my Group Policy references? How do I know what location GP is reading from?
Now I installed the Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7 from here:
Administrative Templates (ADMX) for Windows Server 2008 R2 and
Windows 7
This gave me a "Win7-2008R2-admx.msi" package that I installed. I took the defaults and extracted contents to:
C:\Windows\PolicyDefinitions\Server 2008 Win7\PolicyDefinitions
Are all of these .ADMX files supposed to be placed into my Central Store?
If I mouse-over "Administrative Templates" in Group Policy Manager is says that the policy definitions are retrieved from the local machine.
I then right-clicked on top of "Administrative
Templates" in Group Policy Manager and highlighted Inetres and selected Delete.
While in Add/Remove Templates I click on Add and it defaults to looking for "Policy Templates" and will not let me select and .ADM/.ADML/.ADMX files.
What am I doing wrong here?
How do I know that I'm using the most recent Inetres file?
How do I know which file Group Policy Manager is using to manage the IE settings that are in:
User Configuration->Administrative Templates->Windows Components->Internet Explorer->Compatibility View->Use Policy List of Internet
Explorer 7 sites
or
Computer Configuration->Administrative Templates->Windows Components->Internet Explorer->Compatibility View->Use Policy List of
Internet Explorer 7 sites.
Is there anything else you can suggest?
Many, many thanks in advance for any response

Hi,
Regarding your question, usually we create a Central Store for Administrative Templates (Both .admx and .adml files), and create a folder that is named PolicyDefinitions in the following location:
\\FQDN\SYSVOL\FQDN\policies. The .adml files on the Windows computer
are stored in a language-specific folder. For example, English (United States) .adml files are stored in a folder that is named "en-US." When you have copied all .admx and .adml files, the PolicyDefinitions folder on the domain controller should contain the
.admx files and one or more folders that contain language-specific .adml files.
Please refer to the following articles. You will get more helpful details about the Central Store for Group Policy Administrative Template files.
How to create the Central Store for Group Policy Administrative Template files in Windows Vista
http://support.microsoft.com/kb/929841
Windows 7, Windows Server 2008 R2 and the Group Policy Central Store
http://blogs.technet.com/b/askds/archive/2009/12/09/windows-7-windows-server-2008-r2-and-the-group-policy-central-store.aspx
Based on your description, I understand you enable the setting “Use Policy List of Internet Explorer 7 sites”. However, didn’t show any sites in IE in client even after forcing a GP update
(gpupdate /force). Please use command “gpresult” in clients to collect the GPOs, and then check whether the GPO contain the setting “Use Policy List of Internet Explorer 7 sites” was applied to clients or wasn’t.
In addition, you also can change the related setting by using registry directly.
Follow the path of the registry:
HKEY_CURRENT_USER->Software->Policies->Microsoft->Internet Explorer->BrowserEmulation->PolicyList. (Create registry folders
manually if not present)
Right Click
PolicyList ->New->String Value->Enter the name of the website. (Both under ‘Name’ and ‘Data’. For example,
Value name: example.com Value data: example.com)
There is a similar question, please read as a reference.
Add manually URL on Compatibility View List in IE10
http://social.msdn.microsoft.com/Forums/ie/en-US/5a15e861-d106-471e-a968-fdea15e31c45/add-manually-url-on-compatibility-view-list-in-ie10
Hope this helps.
Best regards,
Justin Gu

Best steps to repopulate the central store in our domain.

Our domain has 2008 R2 & 2003 DC's on our network, group policy central store is configured. We're still using FRS for replication.
We need to update our central store with the latest ADMX files (2012 R2 / Win8.1) but the admx files aren't being replicated to our DC's because of the same file size of the new ADMX files.
What is the best way to repopulate the central store ?

> that's probably the reason for the 13567 errors, i'm just a bit worried
> about replication traffic if I set Suppress Identical Updates To Files to 0.
Since sysvol doesn't change very often: No matter.
> BTW Nice Coke bottle Martin !!
Martin
Mal ein
Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Upgrade of Server 2008 R2 ADMX's to Server 2012/Windows 8 ADMX's - Central Store

Hi
I am looking to upgrade our AD Group Policy centralised store of ADMX files from 2008 R2 to 2012/Windows 8 ADMX files.
I understand the correct procedure is to just overwrite the old files with the newer files, with the caveat that you MAY not be able to edit the GPO's now from a 2008 R2 server.
However I can find no clear defined statement that says this procedure will not corrupt/adjust existing GPO's, this would be 2008 R2 and 2003 level GPO's?
From what I gather, when you open a GPO after the ADMX upgrade, the schema of the GPO file will update to include the existing settings, but will it alter existing settings in any way?
Any feedback will be much appreciated.
Kind Regards
Steven

> However I can find no clear defined statement that says this procedure
> will not corrupt/adjust existing GPO's, this would be 2008 R2 and 2003
> level GPO's?
It will not corrupt/adjust anything.
> will it alter existing settings in any way?
No.
ADMX only defines the GUI you see in gpedit. It does not change existing
content (registry.pol) unless you change something.
Greetings/Grüße,
Martin
Mal ein
gutes Buch über GPOs lesen?
Good or bad GPOs? - my blog…
And if IT bothers me -
coke bottle design refreshment (-:

Deploying computer certificate to the Personal Computer Store using Group Policy

Hi, can someone please confirm if the only way to deploy a computer cert to the Personal store under the Computer branch (Not User branch) is to use an auto-enrollment template & corresponding GPO?
I can see that in group policy you can deploy other types of certs such as intermediate & Root certs etc without using Auto-enrolment, but no option under the Public Key Policies section to deploy a cert to the personal store within
the Computer branch.
Thanks

> Hi, can someone please confirm if the only way to deploy a computer cert
> to the Personal store under the Computer branch (Not User branch) is to
> use an auto-enrollment template & corresponding GPO?
No, you can request a computer cert manually, too. But you cannot deploy
personal certs through GPO because in GPO, the private key cannot be
stored... This is true for both computer and user certs, because from a
CA's perspective, both are simply an entity :)
Greetings/Grüße,
Martin
Mal ein
gutes Buch über GPOs lesen?
Good or bad GPOs? - my blog…
And if IT bothers me -
coke bottle design refreshment (-:

Group Policy and Windows 8.1 questions

I have a few group policy questions. Thanks in advance for taking a look.
I’ve downloaded the Win 8.1/Server 2012 ADMX files. They look to be the same file names as the Win 7 ADMX files. Can I copy them into the PolicyDefinitions folder and still be able create GPOs for either win 7 or Win 8?
If we use a windows 8.1 client with the GPO mmc to create the GPOs (instead of putting the ADMX files on the servers), will the GPO built from the win 8.1 client apply correctly even though its coming down from a DC that doesn’t have those ADMX files?
Does it make a difference if the win 8.1 client we use to create/edit the GPOs is x64 or x86?
We recently needed to add in an admx file for Lync 2013. I put the lync.admx file in the PolicyDefinitions folder on one DC. If we build the GPO from that server, when it replicates out to all the other DCs, does it matter that they don’t have that particular
ADMX file for lync?
How do we organize and structure our ADMX files wherever they end up so that we know which sets are for which operating system? Should we be thinking about deleting the Win 7 ADMX files when the point comes in the future that we are using only Windows 8
and Windows 9?
We are at AD functional level 2003. Do we need to go up in level for any of this to work?

> 1. I’ve downloaded the Win 8.1/Server 2012 ADMX files. They look to be
>    the same file names as the Win 7 ADMX files. Can I copy them into
>    the PolicyDefinitions folder and still be able create GPOs for
>    either win 7 or Win 8?
Yes. Simply overwrite and you'll be fine.
> 2. If we use a windows 8.1 client with the GPO mmc to create the GPOs
>    (instead of putting the ADMX files on the servers), will the GPO
>    built from the win 8.1 client apply correctly even though its coming
>    down from a DC that doesn’t have those ADMX files?
Yes. GPO processing doesn't need ADMX, only GPO editing needs them.
> 3. Does it make a difference if the win 8.1 client we use to
>    create/edit the GPOs is x64 or x86?
No.
> 4. We recently needed to add in an admx file for Lync 2013. I put the
>    lync.admx file in the PolicyDefinitions folder on one DC. If we
>    build the GPO from that server, when it replicates out to all the
>    other DCs, does it matter that they don’t have that particular ADMX
>    file for lync?
If you have a central store for your ADMX, it will automatically
replicate through all DCs. If not, "2." applies anyway.
> 5. How do we organize and structure our ADMX files wherever they end up
>    so that we know which sets are for which operating system? Should we
>    be thinking about deleting the Win 7 ADMX files when the point comes
>    in the future that we are using only Windows 8 and Windows 9?
If you use a central store, update it as required. If not, do nothing
and use a client with the OS version you want to target.
> 6. We are at AD functional level 2003. Do we need to go up in level for
>    any of this to work?
AD level doesn't matter in any aspect. Schema version matters (Bitlocker
and Wireless, eg...), but you can update the Schema easily to 2012 and
have your DCs still run Server 2003.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Group policy didnt work (SYSVOL replication)

Hello experts
I need information and help. I have a 4 domain controller in my domain. 1 domian controller runs windows 2003 SP2 other domains are windows 2008 r2. Today i created Group policy for my testing environment then gpupdate /force from my PC. Then error:
User policy could not be updated successfully. The following errors were encount
ered:
The processing of Group Policy failed. Windows attempted to read the file \\golo
mtbank.local\SysVol\golomtbank.local\Policies\{DEFBC9A3-F3F4-4598-BF04-ADFF097BC
04F}\gpt.ini from a domain controller and was not successful. Group Policy setti
ngs may not be applied until this event is resolved. This issue may be transient
and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller
has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
I checked SYSVOL folders on my DCs. This folder created on primary domain controller but didn't created other 3 servers. Primary domain is Windows 2008 R2. I was moved Policy definitions (ADMX files) retrieved from the local machine to central store about
few months ago.
Please help me how can solve this problem and how can replicate SYSVOL folder. THanks all

> This is my production environments. Is it safe to do so?
Yes, mostly. To verify, check NTFRS event logs on all DCs and post the
last error message you find about replication issues.
Resolution Step by step:
Backup Sysvol on each DC in case replication didn't work for a long time.
On all DCs stop and disable the ntfrs service.
On the PDC (netdom query pdc), do the D4 thing and enable/start ntfrs.
On all other DCs, do the D2 thing and enable/start ntfrs.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

How to set up Group Policy without any server installed

How to set up Group Policy on Win8 without any server installed?
I have set up 50 users on LAN and want to push softwares via one common point. From google I found to deploy Software using Group Policy. But then Group Policy occurs in Servers and I don't have any server set up.

Hello,
a Domain requires at least one Windows server OS machine which has Active Directory installed.
As previous already mentioned from SenneVL this also requires that computers are added to the domain and that you create user accounts in Active Directory users and computers which stores the account information in the Active directory database.
In your case with single computers each machine has its own database(SAM) which stores passwords etc. this is different in a domain.
Each computer has a local policy which will be overwritten from centrally managed policies from the domain.
"The common point would be my PC (Admin PC) ."
This machine can not be used for your needs with software installation for 50 computers.
"How To Use the Group Policy Editor to Manage Local Computer Policy."
This is about the local machine and you cannot manage them for other computers from your Admin PC.
"DOMAIN part: By default Microsoft takes everyone on Workgroup. Is that not a default DOMAIN? or should I make one lets say "ABC" on every PC ?"
NO, this is NOT a domain.
http://windows.microsoft.com/en-us/windows7/what-is-the-difference-between-a-domain-a-workgroup-and-a-homegroup
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter:

Can't see ADMX files in Group Policy Editor

I have a problem with ADMX files on my Server 2008 r2 group policy. I start by going to group policy editor. Then I browse to Computer Policy and then Administrative Templates. There is nothing in there... Which is weird... There has always been stuff there...
So, then I go in to add templates back in... I find the ADMX files in C:\Windows\Policy Definitions and also \\domain\SYSVOL\domain\Policies\PolicyDefinitions and go to Add/Remove Templates. I click add and then browse to either directory (which has ADMX files
in them!) and see nothing. ADM files I can see fine. But ADMX I can't see. So, I see these links:
2008 R2 Server GP can't see admx files
I can't see admx files
Looking at them, they both say I should be able to see ADMX files in the central store...So I manually copy the ones in C:\Windows\Policy Definitions to the SYSVOL central store. Restart group policy editor... Nothing there when I browse the settings...
Still not able to add templates.
It looks like group policy editor doesn't know about ADMX files at all... Is there a registry setting or something that "enables" the ADMX files?
Thanks,
Scott

In gpedit / gpmc, the menu item : "Action -> Add/Remove Templates", is only applicable/useful for the older/legacy ADM files - the menu item isn't relevant for ADMX/ADML files at all.
The most common reason for an "empty" list of Administrative Templates settings, is an incorrect configuration of the Central Store.
The usual guidance tells us to place ADMX files here, to setup a CS:
\\domain\SYSVOL\domain\Policies\PolicyDefinitions\
This folder/file structure has to mimic what you would see at: C:\Windows\PolicyDefinitions\
If your domain is named contoso.com, you would need this:
contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions\
In that folder, reside your ADMX files.
You also need the relevant locale subfolder, and in there, you need the matching ADML files.
The best way to establish that, is to go to C:\Windows\PolicyDefinitions\ on your RSAT PC, or DC, and copy all the contents including subfolders and files, into the equivalent folder of your CS.
Then exit GPMC (if you had it opened), and re-launch GPMC. No need to to anything else in GPMC, it will automatically, by default, look for a CS first, and, if no CS is found, will revert to the local policydefinitions folder structure.
But, if the CS folder structure exists *AND* is incomplete or incorrect, you will get your symptom.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Unable to see Remote App and Desktop Connection in Group Policy Management Editor

I am unable to see the Remote App and Desktop Connection in Group Policy Management Editor on my 2012 R2 DC. I am therefore not able configure the connection URL in Access RemoteApp and desktops in our Windows 8.1 client environment.
Within the Group Policy Under User Configuration, Administrative Templates, Windows Components all I see is:-
RD Gateway
Remote Desktop Connection Client
Remote Desktop Session Host
But NOT
Remote App and Desktop Connection
Which I need. Is there anyway of adding this?

> I am unable to see the Remote App and Desktop Connection in Group Policy
> Management Editor on my 2012 R2 DC. I am therefore not able configure
> the connection URL in Access RemoteApp and desktops in our Windows 8.1
> client environment.
http://gpsearch.azurewebsites.net/#8113
Do you use a central store for ADMX? Is this central store out of date?
(Means "still contains ADMX from W7/2008R2")
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Server 2012 Group Policy Templates installed on Server 2008 R2

Setup: 2 x Domain Controllers running Server 2K8 R2 SP1
We are currently running our environment with IE9 and want to upgrade to IE11. However 2K8 R2 group policy doesnt support IE11 unless you upgrade your DC's to this version of IE. We are not going to deploy IE11 all at once but instead as we reimage or replace
PC's.
My question is can install http://www.microsoft.com/en-us/download/details.aspx?id=36991 Server 2012 templates on 2008 R2 and have the ability to apply GP objects to both versions of the browser? Will it's possibly make some of the current GP's ineffective
by erasing some settings?
Maybe there is a better was for me to do this? Any help on this would be appreciated! Thanks in advance.
I will monitor this thread very closely and reply to any questions as soon as I can. Thanks!
BCU

Yes this can be done and its advisable to install the latest and greatest admx templates, please be aware that from IE10 upwards IE maintenance is deprecated and applied via a GPP, id advise you create a central store for your Admx and adml files if not
already done so
http://support.microsoft.com/kb/929841
http://support.microsoft.com/kb/929841

MBAM Group Policy Problems

I am trying to install and configure MBAM 2.0. I have installed all of the components on two separate servers. Server 1 has sccm 2012
integration and gpo policy templates. Server two has the rest. When I load Group Policy Management the templates do not appear. I have manually extracted and copied the templates in the local policy definitions and still nothing. Any ideas?

By default the Group Policy Management console will look for templates at a central SYSVOL location (a so called central store). Likely you have a PolicyDefinitions folder in
\\domain.com\sysvol\domain.com\Policies and then you need to add the MBAM ADMX and ADML files to that location to be able to see those settings when managing group policies. The reason for this is
that the central store has precedence over local group policy templates.
Blogging about Windows for IT pros at
www.theexperienceblog.com

Can't find setting for IE10 Compatibility View in Group Policy Management Console.

Hoping this is easy.
I'm trying to use the Group Policy setting for Compatibility View under Computer Configuration/Administrative Templates/Windows Components/Internet Explorer and it is not there.
The domain controllers are 2008 Standard SP2, so not R2. We are using ADMX files from a central store.
If I open the local GPEdit on my Windows 7 workstation I can see the setting for Compatibility View but cannot see it using RSAT or on the domain controllers themselves.
How do I get this setting to appear so I can use it?
Thank you.
Kenny

> If I open the local GPEdit on my Windows 7 workstation I can see the
> setting for Compatibility View but cannot see it using RSAT or on the
> domain controllers themselves.
Copy %windir%\policydefinitions from your win7 WS to the central store:
robocopy "%windir%\policydefinitions"
"\\%userdnsdomain%\sysvol\%userdnsdomain%\policies\policydefinitions" /s
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Group Policy Central Store

Similar Messages

Maybe you are looking for