Solved

PolicyDefinition folder safe?

Posted on 2011-03-09
11
1,082 Views
Last Modified: 2012-08-13
We have two 2008 DCs in our network but all clients are XP for now.

We have custom ADM templates and administrative template policy settings

I noticed right after copying the local DCs policydefinition folder C:\Windows\PolicyDefinitions to the Sysvol, that the GPO states that the settings are now pulling from the Central store.

It occurred to me that this may cause issues if an XP machine is trying to find ADM Templates from the central store but doesn't because it now only contains ADMX files.

I can't find articles saying this is an issue or not.

Can someone confirm?
0
Comment
Question by:snyderkv
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 2
  • +1
11 Comments
 
LVL 12

Expert Comment

by:Navdeep
ID: 35093698
Hi,

Why you want such kind of setup. You shouldn't be copying it to sysvol folders. Adm/amdx templates will allow you to see the GPO setting that you have made to it. for example server 2003 wil not be able to see server2008 admx template but that doesn't mean you need to put them in sysvol folder. This will overload you sysvol folder.
0
 

Author Comment

by:snyderkv
ID: 35093776
I have no clue what you are saying.

Read this article. This is a post 2008 DC install step to take advantage of the new feature.

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_Server_2008/A_3786-Installing-ADMX-Administrative-Templates-in-Windows-Server-2008-Group-Policy.html
0
 
LVL 12

Expert Comment

by:Navdeep
ID: 35093919
are you going to manage your GPO's using an xp client?
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 

Author Comment

by:snyderkv
ID: 35093990

No I'm not. We have a 2008 DC to manage the new settings via GPMC. I rarely use my workstation to manage domain wide tasks. I just noticed it seems to run faster and is less glitchy.

Does anyone have the answer to my question?

Will creating the policydefinitions folder screw existing settings up that XP/2003 is using?. (since they use ADM files and not ADMX files)
0
 
LVL 37

Accepted Solution

by:
Neil Russell earned 334 total points
ID: 35094030
Yes the answer is that they are only accessed from sysvol repository when you use GPMC to manage the policyies NOT by clients applying the policy.
0
 
LVL 12

Expert Comment

by:Navdeep
ID: 35094179
These will not be required by the clients as told by Neilsr. Clients have nothing to do with adm/admx templates unless you are going to manage all your GPO from winxp machine only then you would be requiring such a setup.

Hope you get the clue now :)
0
 

Author Comment

by:snyderkv
ID: 35094404
Yeah I get it now.

Crap, some people still use xp/2003 to manage settings, so I guess they won't see the new 2008 settings for preferences?

Not a huge deal I guess.
0
 

Author Comment

by:snyderkv
ID: 35094423
I see that in XP/2003, the preference setting I set is not visible and the administrative templates shows up as extra registry settings.

Ok no big deal, but are we talking about the same thing? Because this happens regardless if I have the policydefinition file or not.
0
 
LVL 21

Assisted Solution

by:snusgubben
snusgubben earned 166 total points
ID: 35094881
In the Central Store you keep your xml based templates and language files. If you have 2 DC's both will use the same templates from that store located in the SYSVOL. If you don't have a Central Store, the DC's will use its own local template. These templates may be different on the 2 DC's.


XP machines don't understand the XML based templates, so only Vista/2008 and later will have the benefit to use the Central Store.

You can though use GPP with XP as long as the XP clients have the GPP client side extension installed (you can get it from Windows/Microsoft Update).
0
 
LVL 37

Assisted Solution

by:Neil Russell
Neil Russell earned 334 total points
ID: 35095597
Although not part of your original question here is a link to the Windows XP Group policies preferences client that you would need installed for them to take effect.

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e60b5c8f-d7dc-4b27-a261-247ce3f6c4f8&displaylang=en

0
 

Author Comment

by:snyderkv
ID: 35096158
Already downloaded and installed the CSEs thanks though and the GPP did work on XP.

I was just making sure I don't break anything by creating the policydefinition folder.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
A hard and fast method for reducing Active Directory Administrators members.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question