none
new GPOs for WMF 5.0

    Question

  • I'm wondering if it is possible to manage the new GPOs (Turn on PowerShell Script Block Logging and Turn on PowerShell Transcription) that come with WMF 5.0 on Windows 7 SP1?  Installing WMF 5.0 on Win7 actually removes the entire "Windows PowerShell" GPO folder, so I can't even manage the older settings now from my Win7 machine.  It works fine on Server 2012 R2 as long as it has both WMF 5.0 and KB3000850 installed.
    Wednesday, June 15, 2016 3:14 PM

Answers

  • I do not have that admin template in that directory.  That file does exist on my system at:

    C:\Windows\winsxs\amd64_microsoft-windows-powershell-adm_31bf3856ad364e35_7.2.7601.16406_none_80feb6b7426c9222

    and

    C:\Windows\winsxs\x86_microsoft-windows-powershell-adm_31bf3856ad364e35_7.2.7601.16406_none_24e01b338a0f20ec

    If I try to add an admin template manually within the local GP editor, the ADMX file won't even show up in the browser.  If I copy the file to c:\windows\policydefinitions and then launch gpedit.msc, it throws the following error twice:

    [Main Instruction]
    Encountered an error while parsing.

    [Content]
    An appropriate resource file could not be found for file C:\Windows\PolicyDefinitions\PowerShellExecutionPolicy.admx (error = 2): The system cannot find the file specified.

    Note that this file did exist in c:\windows\policydefinitions and the GP settings group worked just fine prior installing WMF 5.0.  Also note that this has been repeated on three different Win 7 SP1 machines, so it is not a one-time fluke.  I suspect if you have a Win 7 SP1 (64-bit) machine lying around you'd see the same behavior.

    Oh, I also grabbed that file from a Server 2012 R2 machine and tried using it on my Win 7 machine, but that failed with the same error as above.  And that file is definitely different (newer) than the local copy on my Win 7 machine.

    for each ADMX file there needs to be an accompanying ADML file in the relevant <MUIculture> subfolder e.g. \en-US\

    If you have the ADMX but not the ADML, you will get the error you are seeing.

    I'm not sure why the files are missing/present on Win7 before/after the WMF 5 package is applied, but you should be able to copy the files from any other machine, or the template download packages, and extract/copy the one you need.

    These files are present on my Win10 machine. I've not checked my Win7 machine (which has WMF 5 installed) but I'll check that out and let you know.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Monday, June 20, 2016 8:57 PM

All replies

  • Hi,

    Thanks for your post.

    You could only audit PowerShell Usage using Transcription and Logging.

    The new feature of WMF 5.0:

    1.Just Enough Administration (JEA)

    2.Creating Custom Types using PowerShell Classes

    3.Improvements in PowerShell Script Debugging

    4.Improvements in Desired State Configuration (DSC)

    5.Audit PowerShell Usage using Transcription and Logging

    6.Software Discovery, Install and Inventory with PackageManagement

    7.PowerShell Module Discovery, Install and Inventory with PowerShellGet

    8.PowerShell Script Discovery, Install and Management with PowerShellGet

    9.New and updated cmdlets based on community feedback

    10.Information Stream

    11.Generate PowerShell Cmdlets based on OData Endpoint

    12.Network Switch Management with PowerShell

    13.Software Inventory Logging (SIL)

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, June 20, 2016 6:48 AM
    Moderator
  • Do you not have the admin templates @ c:\windows\policydefinitions\ "PowerShellExecutionPolicy.admx" and "PowerShellExecutionPolicy.adml"  ?

    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Monday, June 20, 2016 7:48 AM
  • I do not have that admin template in that directory.  That file does exist on my system at:

    C:\Windows\winsxs\amd64_microsoft-windows-powershell-adm_31bf3856ad364e35_7.2.7601.16406_none_80feb6b7426c9222

    and

    C:\Windows\winsxs\x86_microsoft-windows-powershell-adm_31bf3856ad364e35_7.2.7601.16406_none_24e01b338a0f20ec

    If I try to add an admin template manually within the local GP editor, the ADMX file won't even show up in the browser.  If I copy the file to c:\windows\policydefinitions and then launch gpedit.msc, it throws the following error twice:

    [Main Instruction]
    Encountered an error while parsing.

    [Content]
    An appropriate resource file could not be found for file C:\Windows\PolicyDefinitions\PowerShellExecutionPolicy.admx (error = 2): The system cannot find the file specified.

    Note that this file did exist in c:\windows\policydefinitions and the GP settings group worked just fine prior installing WMF 5.0.  Also note that this has been repeated on three different Win 7 SP1 machines, so it is not a one-time fluke.  I suspect if you have a Win 7 SP1 (64-bit) machine lying around you'd see the same behavior.

    Oh, I also grabbed that file from a Server 2012 R2 machine and tried using it on my Win 7 machine, but that failed with the same error as above.  And that file is definitely different (newer) than the local copy on my Win 7 machine.

    Monday, June 20, 2016 3:07 PM
  • I do not have that admin template in that directory.  That file does exist on my system at:

    C:\Windows\winsxs\amd64_microsoft-windows-powershell-adm_31bf3856ad364e35_7.2.7601.16406_none_80feb6b7426c9222

    and

    C:\Windows\winsxs\x86_microsoft-windows-powershell-adm_31bf3856ad364e35_7.2.7601.16406_none_24e01b338a0f20ec

    If I try to add an admin template manually within the local GP editor, the ADMX file won't even show up in the browser.  If I copy the file to c:\windows\policydefinitions and then launch gpedit.msc, it throws the following error twice:

    [Main Instruction]
    Encountered an error while parsing.

    [Content]
    An appropriate resource file could not be found for file C:\Windows\PolicyDefinitions\PowerShellExecutionPolicy.admx (error = 2): The system cannot find the file specified.

    Note that this file did exist in c:\windows\policydefinitions and the GP settings group worked just fine prior installing WMF 5.0.  Also note that this has been repeated on three different Win 7 SP1 machines, so it is not a one-time fluke.  I suspect if you have a Win 7 SP1 (64-bit) machine lying around you'd see the same behavior.

    Oh, I also grabbed that file from a Server 2012 R2 machine and tried using it on my Win 7 machine, but that failed with the same error as above.  And that file is definitely different (newer) than the local copy on my Win 7 machine.

    for each ADMX file there needs to be an accompanying ADML file in the relevant <MUIculture> subfolder e.g. \en-US\

    If you have the ADMX but not the ADML, you will get the error you are seeing.

    I'm not sure why the files are missing/present on Win7 before/after the WMF 5 package is applied, but you should be able to copy the files from any other machine, or the template download packages, and extract/copy the one you need.

    These files are present on my Win10 machine. I've not checked my Win7 machine (which has WMF 5 installed) but I'll check that out and let you know.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Monday, June 20, 2016 8:57 PM
  • I downloaded the Win7AndW2K8R2-KB3134760-x64.msu and Win7-KB3134760-x86.msu files for WMF5, and expanded the content.

    I then expanded the internal CAB file, and within each, there are ADMX and ADML files but none named PowerShellExecutionPolicy.admx nor PowerShellExecutionPolicy.adml

    Only contains windowsremotemanagement.admx/adml, windowsremoteshell.admx.adml, eventforwarding.admx/adml

    None of these templates appear to contain the executionpolicy related settings.

    Curiouser and curiouser... 


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Monday, June 20, 2016 9:11 PM
  • These files are present on my Win10 machine. I've not checked my Win7 machine (which has WMF 5 installed) but I'll check that out and let you know.

    Just checked my Win7SP1 32bit PC.
    It only has WMF 4.0 via Windows6.1-KB2819745-x86-MultiPkg.msu
    The GP admin templates (PowerShellExecutionPolicy.admx) are still present.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Tuesday, June 21, 2016 11:11 PM
  • Are you going to update it to WMF 5.0 and see what happens?  Kind of curious to see what it does on a 32-bit system.
    Wednesday, June 22, 2016 2:41 PM
  • I'll tackle installing WMF5 on a 32bit and 64bit Win7 today if I get the chance, and let you know

    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Wednesday, June 22, 2016 9:33 PM