Windows 10 Client Group Policy Object for SBS 2011/2008 R2


I am trying to gather information on how to implement the Windows 10 Client group policy object in an SBS 2011/2008 R2 domain.  Right now my current SBS 2011 domain controller only lists the standard Windows XP/Vista/7/8 client group policy object and after joining a Windows 10 PC to my domain it will not apply either of them and is filtered out.  I am wondering if there will be any GPO templates available specifically for Windows 10 to implement.  

Any information is appreciated.  

Thank you
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

1 - Create a Central Store
2 - Add Windows 10 ADMX files central store
3 - Create your own GPO for Windows 10 computers and link them to the OU with the Windows 10 Computer Objects
Cliff GaliherCommented:
There has been no indication that the SBS team will release updated client GPOs for windows 10. You can create your own WMI filters and you can edit win10 specific settings from a machine running win10, but there isn't any SBS magic happening there. I also have not yet seen an RSAT release for win17, but I'd be surprised if one doesn't surface very soon.
ColumbiaMarketingAuthor Commented:
Thank you for the information.  So I just created a new OU and moved the Windows 10 PC to it, then I copied the Windows SBS Client - Windows 7 Policy and changed the Windows 7 WMI Filter it had to <none> and applied it to the new OU.  After running a group policy update on the Windows 10 PC it successfully applied the group policy.  Would this be the preferred way for now?  

Will SBS 2011 or Server 2008 R2 ever have updated settings for Windows 10?  For example, I also use WSUS for updates and even though the Windows 10 Enterprise client is showing in the WSUS console it lists it as a Vista Enterprise computer.  Is there a way for SBS and any program it uses to list Windows 10 computers accurately?
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

Cliff GaliherCommented:
On the business side of things, there is still murkiness. The windows business store has not launched yet. Windows Update for Business has not launched. No RSAT. No final system center/MDT patches.

I would think WSUS would get an update, but that's purely speculation on my part. Right now, my personal feeling is that Win17's launch is very consumer focused (not necessarily a bad thing) and while IT pros should be evaluating it for business use, deploying it might be a month or two out yet while those final bits get rolled out.
ColumbiaMarketingAuthor Commented:
That definitely seems to be the case here.  My goal with this was to simply evaluate and so far it doesn't seem like everything is available to successfully deploy Windows 10 in a 2008 R2 domain unless you are willing to tailor specific policies/settings for it.  

At this point I think I will wait a little longer to see when the business side gets more updates itself.
Not sure what cliff is talking about.  The ADMX files are on the Windows 10 client - the SBS team has nothing to do with it.   Check %systemroot%\policydefinitions.   Like I said before create the central store and copy the ADMX files and the language folder (en-us) to the central store.  Once this is done you have the latest policy templates.  The next thing is to move the windows 10 computer objects into their own ou and create and link your policies there.  Don't worry about wmi queries ...
Oh and windows 10 enterprise is out August 1st and volume license keys will be available in the vlsc then. ...
ColumbiaMarketingAuthor Commented:
Very interesting h1r0.  I contacted Microsoft and they claim that currently there is no new ADMX templates for Windows 10 and that they need more time for release.  Out of curiosity where are you finding the ADMX templates for it?
Same place it always is .... C:\windows\policydefinitions
ColumbiaMarketingAuthor Commented:
h1r0, you are correct in that you can copy the templates from a Windows 10 client so I'm not sure why I got a conflicting answer from Microsoft on that.  Is it possible the SBS/Server 2008 R2 ADMX templates will be different than what is currently on a Windows 10 client?
When they release ADMX templates for 10 it will be identical to whats in the policy definitions folder on a windows 10 client at that time.  Windows 10 is going to be updated frequently so I just plan to periodically copy the ADMX files from a recently updated client to get the most current templates.
I realize I didn't answer your question fully.  The templates on sbs/2008 would be different from the ones on a windows 10 client - this is why you copy the latest ADMX files over to the central store.
ColumbiaMarketingAuthor Commented:
Since h1r0 is correct in that you can copy the ADMX files from a Windows 10 client my solution should be updated to reflect that.  Cliff Galiher is correct that there hasn't been much data officially released for Windows 10, but h1r0's suggestion will work as well.
ColumbiaMarketingAuthor Commented:
h1r0, if I Implement the Windows 10 ADMX files the way you suggest would I loose any prior control on the SBS server for my standard Windows 7 clients?  I currently only have a couple Windows 10 clients so I want to preserve everything I currently have in Group Policy for Windows 7.
- first create your central store using the method above.  Use the ADMX files and language files from your sbs server to populate the store first.  

- then copy the ADMX files and language files from the 2008 server to the store and overwrite duplicates. Dont copy the folders, just copy the files to their respective folders.

- do the same for windows 7, windows 8, and finally 10

That should ensure the store has all the ADMX files required.  You can always remove the store and the DC will revert back to the local store so it's pretty easy to roll back if you need to.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ColumbiaMarketingAuthor Commented:
Thank you h1r0.  So by doing this will I loose any current Group Policies that I already have set up for my servers and Windows 7 clients or will everything carry over?  I just don't want to have to set up all my current group policies again if I can avoid it.  And since all my servers are 2008 R2, and SBS 2011 is based on 2008 R2, will my current SBS 2011 ADMX files be sufficient, or would there be a need to copy them from another server running 2008 R2?
David Johnson, CD, MVPOwnerCommented:
There are group policies and there are the definitions.. These are two entirely different items. The actual group policy is stored in a {GUID} folder  which holds the gpt.ini folder and the registry entries
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 10

From novice to tech pro — start learning today.