none
Unable To View Admin Template Policy Defs Retrieved From Central Store (Created With SCM)

    Question

  • I have created a policy in SCM I am happy with which I have exported into a domain based GPO. The problemI am having is that I am unable to see the Administrative Template settings in the Group Policy Management Editor in Windows 7. This is getting the templates from the Central Store and I assume the problem I am having is because my new policy doesn't exist as an ADMX file in the Central Store. So how do I get round this? Is there a way to export as an admx from SCM or any way to convert the policies created in SCM into ADMX's?

    Thank you

    Monday, December 19, 2011 10:18 AM

Answers

  • Bondy;

    No, there isn't a way to export ADMX files from SCM.

    The problem you describe doesn't make sense to me because most of the settings in SCM were initially derived from ADMX files. One of my colleagues created a tool that converts ADMX/ADML file pairs into a format that we could import into SCM, then we added a more data about each setting manually, such as the Potential Impact and Vulnerability text. Obviously, the settings that aren't admin template settings to start with were not created in this way, e.g. the settings located at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. Those information the group policy tools need to render those settings are not stored in the central store, so I don't see how any of them would be causing you issues. Perhaps you're talking about the settings with the MSS: prefix? If you are talking about the MSS settings please read the section "Update the Security Configuration Editor UI" in the Windows Server 2008 R2 SP1 security guide.


    Kurt Dillard http://www.kurtdillard.com
    • Marked as answer by bondy666 Monday, December 19, 2011 4:41 PM
    Monday, December 19, 2011 3:31 PM
    Owner
  • Hi Kurt, no I wasn't talking about MSS settings, those are fine. However, on reading back your answer it just occured to me what I was doing wrong/expecting to see. I thought initially that a domain GPO would also be reflected in the local GPO policy after it had applied (ie I'd be able to see it in GPEdit). I realise this is incorrect with hindsight and so all is actually how it should be. Once again thank you for your answer.
    • Marked as answer by bondy666 Monday, December 19, 2011 4:41 PM
    Monday, December 19, 2011 4:41 PM

All replies

  • Bondy;

    No, there isn't a way to export ADMX files from SCM.

    The problem you describe doesn't make sense to me because most of the settings in SCM were initially derived from ADMX files. One of my colleagues created a tool that converts ADMX/ADML file pairs into a format that we could import into SCM, then we added a more data about each setting manually, such as the Potential Impact and Vulnerability text. Obviously, the settings that aren't admin template settings to start with were not created in this way, e.g. the settings located at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. Those information the group policy tools need to render those settings are not stored in the central store, so I don't see how any of them would be causing you issues. Perhaps you're talking about the settings with the MSS: prefix? If you are talking about the MSS settings please read the section "Update the Security Configuration Editor UI" in the Windows Server 2008 R2 SP1 security guide.


    Kurt Dillard http://www.kurtdillard.com
    • Marked as answer by bondy666 Monday, December 19, 2011 4:41 PM
    Monday, December 19, 2011 3:31 PM
    Owner
  • Hi Kurt, no I wasn't talking about MSS settings, those are fine. However, on reading back your answer it just occured to me what I was doing wrong/expecting to see. I thought initially that a domain GPO would also be reflected in the local GPO policy after it had applied (ie I'd be able to see it in GPEdit). I realise this is incorrect with hindsight and so all is actually how it should be. Once again thank you for your answer.
    • Marked as answer by bondy666 Monday, December 19, 2011 4:41 PM
    Monday, December 19, 2011 4:41 PM
  • OK Bondy, please let us know if you have more questions or any ideas for making SCM better. Also, we will soon release beta versions of several updated baselines, if you're not in our beta program already you may want to sign up in Connect: https://connect.microsoft.com/site715/
    Kurt Dillard http://www.kurtdillard.com
    Monday, December 19, 2011 5:37 PM
    Owner