none
Removing Central Store

    Question

  • What are the potential issues of removing the central store so that I am always using the local store?  Will it disable or corrupt any existing GPO's in the environment?   Any other possible issues that could arise from removing the central store?

    This may be a better option for me since I am having so many issues currently, when we upgrade all of our servers to Server 2012 R2 I can then go back to using the central store perhaps.

    Thank you for any help


    John Millsap

    Thursday, May 28, 2015 1:32 PM

Answers

  • Hello,

    you talk a out the Internet settings when configuring GPP?

    Therefor you have to use at least a Windows 8 or Windows Server 2012 with GPMC installed. On earlier OS version the IE 10 Menu is NOT shown. Also be aware that for IE 11 NO menu will be shown, IE 10 is for both versions to use.


    Best regards

    Meinolf Weber

    MVP, MCP, MCTS

    Microsoft MVP - Directory Services

    My Blog: http://blogs.msmvps.com/MWeber

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    Twitter:  

    • Marked as answer by John Millsap Friday, May 29, 2015 12:22 PM
    Thursday, May 28, 2015 2:27 PM
  • Agreed, stick with the central store it was created for a reason that all administrators have a holistic view of the same settings and templates. Figure out the IE issue not the central store issue as that's not broken, As Meinolf says you will need a windows 8 machine or 2012 to administer settings to IE11 out of the box but there is tweak you can make to get settings to apply from an older OS by modifying an xml.

    Do you have a windows 8 machines anywhere? If so download and use RSAT for windows 8

    • Marked as answer by John Millsap Friday, May 29, 2015 12:22 PM
    Thursday, May 28, 2015 2:47 PM
  • Wont hurt however best practice to do anything your unsure of is to do out of hours. No reason to believe it wont start again.

    As for the copying are you on the server or browsing to the sysvol location? as i stated in the other thread you may need to take ownership

    • Marked as answer by John Millsap Friday, May 29, 2015 12:22 PM
    Thursday, May 28, 2015 3:28 PM

  • Hi John,

    >>It does appear to be a permissions issue, as I drill down and look at the effective permissions on the subfolders, even with ownership, it will not give me full access or write access to the files and folders.  It appears to be a domain policy in effect, all of the people who put this together are gone, only a few of us new guys left to try and figure out whats going on

    As I suggested in this thread 10/11 Administrative Templates, we can use an administrator account to take ownership of the folder PolicyDefinitions and the language folder, and make sure the administrator has enough access (Full Control, for example) to all the subfolders and files.

    Besides, for administrative template files are used to display the settings in Group Policy tools like gpmc.msc and gpedit.msc. If necessary, we can completely delete the original PolicyDefinitions folder and replace it with the latest one we have downloaded. 

    Best regards,

    Frank Shen


    Friday, May 29, 2015 7:05 AM
    Moderator

All replies

  • Hello,

    if you remove the central store you might see in GPMC for the GPOs "Extra registry settings" instead the real policy with the correct used .admx file as the .admx file may not be on the machine where you have opened GPMC.

    The settings will stay for the GPO and the GPO itself will not be removed. For testing we have played around with using and not using the central store.

    What kind of problems do you have with the central store in detail?

    As long as all .admx and .adml files are inside for the software you like to manage this is the best option you can  use without having problems with outdated or missing files on local machines.


    Best regards

    Meinolf Weber

    MVP, MCP, MCTS

    Microsoft MVP - Directory Services

    My Blog: http://blogs.msmvps.com/MWeber

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    Twitter:  

    Thursday, May 28, 2015 1:37 PM
  • I just cant seem to get IE 10/11 to pull down settings, I can get some but not all, not sure what I am doing wrong, I associated it with having outdated admx templates.

    Thank you for any help.


    John Millsap

    Thursday, May 28, 2015 1:44 PM
  • Hello,

    you talk a out the Internet settings when configuring GPP?

    Therefor you have to use at least a Windows 8 or Windows Server 2012 with GPMC installed. On earlier OS version the IE 10 Menu is NOT shown. Also be aware that for IE 11 NO menu will be shown, IE 10 is for both versions to use.


    Best regards

    Meinolf Weber

    MVP, MCP, MCTS

    Microsoft MVP - Directory Services

    My Blog: http://blogs.msmvps.com/MWeber

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    Twitter:  

    • Marked as answer by John Millsap Friday, May 29, 2015 12:22 PM
    Thursday, May 28, 2015 2:27 PM
  • Agreed, stick with the central store it was created for a reason that all administrators have a holistic view of the same settings and templates. Figure out the IE issue not the central store issue as that's not broken, As Meinolf says you will need a windows 8 machine or 2012 to administer settings to IE11 out of the box but there is tweak you can make to get settings to apply from an older OS by modifying an xml.

    Do you have a windows 8 machines anywhere? If so download and use RSAT for windows 8

    • Marked as answer by John Millsap Friday, May 29, 2015 12:22 PM
    Thursday, May 28, 2015 2:47 PM
  • I am using Windows 8/8.1 or Server 2012 R2 with GPMC to administer IE 10, but for some reason when I apply some of the settings they still do not get pushed down or inherited, some settings do, this is what led me to think that my templates were out of date they are dated "6/10/2009" and I am trying to copy newer ones over but I am getting permission denied messages..

    John Millsap

    Thursday, May 28, 2015 3:10 PM
  • I am assuming that its the Group Policy Client that is preventing me from copying over the new admx files, will it hurt anything to temporarily stop that service in order to copy over the updated templates?  Is there any reason to think that it wouldnt start again after copying over the new templates?  I want to try updating my templates to see if that helps with my issue of some of the settings working and some not with IE 10.

    John Millsap

    Thursday, May 28, 2015 3:15 PM
  • Wont hurt however best practice to do anything your unsure of is to do out of hours. No reason to believe it wont start again.

    As for the copying are you on the server or browsing to the sysvol location? as i stated in the other thread you may need to take ownership

    • Marked as answer by John Millsap Friday, May 29, 2015 12:22 PM
    Thursday, May 28, 2015 3:28 PM
  • I am on the server itself.  I took ownership and still having the same issue of being unable to copy them over.  I will wait and try the other after hours.  It does appear to be a permissions issue, as I drill down and look at the effective permissions on the subfolders, even with ownership, it will not give me full access or write access to the files and folders.  It appears to be a domain policy in effect, all of the people who put this together are gone, only a few of us new guys left to try and figure out whats going on.  (With help from you guys of course, lol)

    John Millsap

    Thursday, May 28, 2015 3:48 PM

  • Hi John,

    >>It does appear to be a permissions issue, as I drill down and look at the effective permissions on the subfolders, even with ownership, it will not give me full access or write access to the files and folders.  It appears to be a domain policy in effect, all of the people who put this together are gone, only a few of us new guys left to try and figure out whats going on

    As I suggested in this thread 10/11 Administrative Templates, we can use an administrator account to take ownership of the folder PolicyDefinitions and the language folder, and make sure the administrator has enough access (Full Control, for example) to all the subfolders and files.

    Besides, for administrative template files are used to display the settings in Group Policy tools like gpmc.msc and gpedit.msc. If necessary, we can completely delete the original PolicyDefinitions folder and replace it with the latest one we have downloaded. 

    Best regards,

    Frank Shen


    Friday, May 29, 2015 7:05 AM
    Moderator
  • I didn't want to have to take ownership one file at a time but that's what I had to do, I tried running the "takeown" command but it didn't work either (access denied).  But, after taking ownership one file at a time, I was finally able to copy over the old templates and get this done.  I was a bit lazy however and only copied over the new ones that I had to have, will there be any issues with leaving the others the older format until I have to update them?  We are upgrading our DC's in a few months so then it wont be an issue anyway.

    Thanks very all of the information, made me confident enough to go forward and stop worrying about breaking something.


    John Millsap

    Friday, May 29, 2015 12:21 PM
  • I was finally able to get the updated templates copied and this appears to have fixed my problems, it seems a bit weird that we have to go in and take ownership of them one at a time to copy over them though.

    Thanks very much for all of the help, its greatly appreciated.


    John Millsap


    Friday, May 29, 2015 12:24 PM