none
Policy definition corrupted?

    Question

  • I am trying to edit a Group Policy on a server 2012R2 box.

    I get a popup error which says "Resource '$(string.VerMgmtAuditModeEnable)' referenced in attribute displayName could not be found. File c:\windows\policydefinitions\inetres.admx, line 1495, column 249"

    And the InternetExplorer nodes are completely missing from the policy editing Window (under User Policies, Administrative Templates\Windows Components) so I can't view or edit these settings.  I have five DC's in the domain and - not surprisingly - they all show the same symptoms.

    SFC doesn't find anything to object to.

    Do I have a corrupted file? How can I  (should I) attempt to repair this?


    No sig is a good sig

    Tuesday, December 9, 2014 2:51 PM

Answers

  • Hi Andrew,

    >>I have five DC's in the domain and - not surprisingly - they all show the same symptoms.

    Based on the description, we should use Central Store for storing .admx files. The location for Central Store is:

    %systemroot%\sysvol\domain\policies\PolicyDefinitions

    >>get a popup error which says "Resource '$(string.VerMgmtAuditModeEnable)' referenced in attribute displayName could not be found. File c:\windows\policydefinitions\inetres.admx, line 1495, column 249"

    To fix the issue, we can try to copy inetres.admx and inetres.adml from %systemroot%\policyDefinitions folder on a computer with no such problem and then copy the files to the Central Store; or we can try to download the inetre.admx and inetres.adml from Microsoft download center.

    Specifically, the location for inetres.admx is:

    %systemroot%\sysvol\domain\policies\PolicyDefinitions 

    The location for inetres.adml is:

    %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture] (for example, the U.S. English ADMX language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us)

    If we want to choose to download the .admx files for internet explorer, the following link can be referred to.

    Administrative Templates for Internet Explorer

    http://www.microsoft.com/en-in/download/details.aspx?id=40905

    TechNet Subscriber Support
    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

    Best regards,

    Frank Shen
    • Edited by Frank Shen5Moderator Wednesday, December 10, 2014 7:53 AM
    • Proposed as answer by Calin Liviu Wednesday, December 10, 2014 8:32 AM
    • Marked as answer by AndrewDu Monday, December 22, 2014 10:22 AM
    Wednesday, December 10, 2014 7:53 AM
    Moderator

All replies

  • Hi Andrew,

    >>I have five DC's in the domain and - not surprisingly - they all show the same symptoms.

    Based on the description, we should use Central Store for storing .admx files. The location for Central Store is:

    %systemroot%\sysvol\domain\policies\PolicyDefinitions

    >>get a popup error which says "Resource '$(string.VerMgmtAuditModeEnable)' referenced in attribute displayName could not be found. File c:\windows\policydefinitions\inetres.admx, line 1495, column 249"

    To fix the issue, we can try to copy inetres.admx and inetres.adml from %systemroot%\policyDefinitions folder on a computer with no such problem and then copy the files to the Central Store; or we can try to download the inetre.admx and inetres.adml from Microsoft download center.

    Specifically, the location for inetres.admx is:

    %systemroot%\sysvol\domain\policies\PolicyDefinitions 

    The location for inetres.adml is:

    %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture] (for example, the U.S. English ADMX language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us)

    If we want to choose to download the .admx files for internet explorer, the following link can be referred to.

    Administrative Templates for Internet Explorer

    http://www.microsoft.com/en-in/download/details.aspx?id=40905

    TechNet Subscriber Support
    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

    Best regards,

    Frank Shen
    • Edited by Frank Shen5Moderator Wednesday, December 10, 2014 7:53 AM
    • Proposed as answer by Calin Liviu Wednesday, December 10, 2014 8:32 AM
    • Marked as answer by AndrewDu Monday, December 22, 2014 10:22 AM
    Wednesday, December 10, 2014 7:53 AM
    Moderator
  • I am trying to edit a Group Policy on a server 2012R2 box.

    I get a popup error which says "Resource '$(string.VerMgmtAuditModeEnable)' referenced in attribute displayName could not be found. File c:\windows\policydefinitions\inetres.admx, line 1495, column 249"

    And the InternetExplorer nodes are completely missing from the policy editing Window (under User Policies, Administrative Templates\Windows Components) so I can't view or edit these settings.  I have five DC's in the domain and - not surprisingly - they all show the same symptoms.

    SFC doesn't find anything to object to.

    Do I have a corrupted file? How can I  (should I) attempt to repair this?


    No sig is a good sig

    you are most likely suffering a mismatch of inetres.admx vs. inetres.adml (i.e. inetres.admx has a reference to a non-existent element/label within inetres.adml)

    just like this guy :)
    https://social.technet.microsoft.com/Forums/en-US/bac54114-54d7-472b-969d-9b08f28dbba9/error-when-selecting-administrative-template-in-any-gpo?forum=winserverGP


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    • Proposed as answer by Calin Liviu Wednesday, December 10, 2014 8:32 AM
    Wednesday, December 10, 2014 8:28 AM
  • Hi,

    You could copy over a good one from a different server same 2012 R2 OS. This depends also on the IE level on the server. Make sure you copy both admx/adml files.

    Hope this helps.

    Regards,

    Calin

    Wednesday, December 10, 2014 8:31 AM
  • > I get a popup error which says "Resource
    > '$(string.VerMgmtAuditModeEnable)' referenced in attribute displayName
    > could not be found. File c:\windows\policydefinitions\inetres.admx, line
    > 1495, column 249"
     
    Seems google/bing are broken in your copy of the internet :-))
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    Wednesday, December 10, 2014 9:24 AM
  • I am sure you're correct.

    I am finding I can't over-write the files in c:\windows\policydefinitions because nobody except "Trusted Installer" has write permissions.

    Of course I could hack this by changing the owner of the directory and giving myself permissions, but is this likely to break anything? Is there a clean recommended way to install this update?

    The instructions given by MS on the download page tell you to "copy /y" which just results in an "Access Denied" message.

    I really don't want to break my production DC's...

    Thanks!


    No sig is a good sig

    Tuesday, December 16, 2014 3:08 PM
  • > Of course I could hack this by changing the owner of the directory and
    > giving myself permissions, but is this likely to break anything?
     
    It will not break anything, just do it.
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    Tuesday, December 16, 2014 3:26 PM
  • I am finding I can't over-write the files in c:\windows\policydefinitions because nobody except "Trusted Installer" has write permissions.

    Of course I could hack this by changing the owner of the directory and giving myself permissions, but is this likely to break anything? Is there a clean recommended way to install this update?

    The instructions given by MS on the download page tell you to "copy /y" which just results in an "Access Denied" message.

    I really don't want to break my production DC's...

    "TrustedInstaller" is the security entity used by WindowsSetup to "own" all system/protected files.
    Because the Admin Templates are deployed as part of the OS setup routine, those files are secured in this way.

    The MSFT documentation and the updated Admin Templates files don't cover the necessary steps properly, so it kind of is a hack, but this is what you have to do to update the template files, and after doing this heaps of times over many years, I've never had issues arise.

    Really, MSFT should probably either properly document the steps to include this, or, package up the revised template files with a proper installer package which would correctly update the files using the correct installer/servicing methods.

    I agree with Martin, it won't break anything - just do it.

    (side note: I'll raise this with MSFT through formal channels but it's not likely to be addressed anytime this century :(


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Tuesday, December 16, 2014 8:10 PM
  • I hacked it; nothing broke; I can now edit my Policy correctly.

    Thanks everyone for your help.


    No sig is a good sig

    Monday, December 22, 2014 10:23 AM