none
What happens to my Windows 7 settings when I import Windows 10 1511 ADMX files

    Question

  • I am starting to build the infrastructure around Windows 10, but my environment is still all Windows 7 and a few XP machines.

    I need to import the Windows 10 ADMX files into the central store so that I can begin to work on the policies to control Windows 10.  I am worried about what will happen to the Windows 7 settings in my policies.

    Do the policies that are depreciated in the new ADMX files disappear or are they just no longer editable?  I have read some posts on line about settings disappearing from older OS GPOs and that would be a disaster for me.  Is there any way to start working on Windows 10 GPOs without losing the ability to fully manage Windows 7?

    Is this not something I need to worry about even though there are several posts with people complaining about their older GPOs getting messed up after updating to the Windows 10 ADMX files?

    Thursday, August 4, 2016 5:49 PM

Answers

  • I'll answer your second question first - you could technically manage each set of settings from the GPMC on each client. That becomes a lot more work though! Especially if you start managing other applications like Office, Chrome, Adobe Reader, etc through Group Policy. You would have to copy those ADMXs to every machine you want to use.

    The only issue that I'm aware of with the newer ADMXs is related to the depreciated GP extension: IE Maintenance. Machines running IE11 lose the ability to manage those old settings. If you migrate those settings to Preferences or Administrative Templates ahead of time, you should be fine. Here is a guide I wrote on the central store that might help you: https://deployhappiness.com/creating-the-group-policy-central-store-updated-for-windows-8-12012r2/


    If my answer helped you, check out my blog: Deploy Happiness

    Thursday, August 4, 2016 6:47 PM
  • I am starting to build the infrastructure around Windows 10, but my environment is still all Windows 7 and a few XP machines.

    I need to import the Windows 10 ADMX files into the central store so that I can begin to work on the policies to control Windows 10.  I am worried about what will happen to the Windows 7 settings in my policies.

    Updating/changing ADMX files (or, even deleting ADMX files), has *zero* affect on existing GPOs... None at all...

    Your existing GPOs will continue to be applied/processed exactly as before.

    ADMX/ADML files are Templates - templates are used for display purposes, and only within the GPMC/GPME and the GPresult/RSoP toolsets - templates are not used in any way during the apply/processing of a GPO.

    If you do add/remove/update template files, either in a local template store (c:\windows\policydefinitions\) or in the CS, those toolsets mentioned above will reflect your template file changes. In doing that, the toolsets will follow the directives in the template files, i.e. will not show settings, or will show changed settings, etc.

    The *settings*, are what you *can* set ------ the *values*, are what you *have* set...
    e.g. "set the proxy" is a setting... proxy=http://squid01.contoso.com, is the value of that "set the proxy" setting....
    Updating/changing templates will *not* modify that *value*, but, a newer template *might* no longer have that *setting*, which would mean that once the newer templates are placed in the local or central store, the toolsets won't display or allow a way to view/set/edit/remove that particular *setting*.

    As Joseph mentions, one of the most notable changes introduced was the deprecation of the old IEM settings. This was actually deprecated in IE10: https://technet.microsoft.com/en-au/library/jj890998.aspx and carried forward since then. IEM is ancient and horrible.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Thursday, August 4, 2016 9:46 PM
  • A related question...

    Do I even need to update the central store if I will run GPMC from the same OS as the one I am trying to manage?

    I mean if I open GPMC from Windows 7SP1, will all the options for Windows 7SP1 be there?

    Similarly, if I do not send the updates for Windows 10 1511 to the central store, can I still use GPMC on a Windows 10 1511 machine to create policies that take advantage of the new stuff while leaving the DCs alone?

    If you have implemented the CS, by default, all computers in the domain will refer to the CS to obtain the template files and so will ignore the local store. There is a registry key to override that, should you need to do so e.g. for a specific computer to use the toolsets with older templates..

    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Thursday, August 4, 2016 9:53 PM

All replies

  • A related question...

    Do I even need to update the central store if I will run GPMC from the same OS as the one I am trying to manage?

    I mean if I open GPMC from Windows 7SP1, will all the options for Windows 7SP1 be there?

    Similarly, if I do not send the updates for Windows 10 1511 to the central store, can I still use GPMC on a Windows 10 1511 machine to create policies that take advantage of the new stuff while leaving the DCs alone?

    Thursday, August 4, 2016 5:56 PM
  • I'll answer your second question first - you could technically manage each set of settings from the GPMC on each client. That becomes a lot more work though! Especially if you start managing other applications like Office, Chrome, Adobe Reader, etc through Group Policy. You would have to copy those ADMXs to every machine you want to use.

    The only issue that I'm aware of with the newer ADMXs is related to the depreciated GP extension: IE Maintenance. Machines running IE11 lose the ability to manage those old settings. If you migrate those settings to Preferences or Administrative Templates ahead of time, you should be fine. Here is a guide I wrote on the central store that might help you: https://deployhappiness.com/creating-the-group-policy-central-store-updated-for-windows-8-12012r2/


    If my answer helped you, check out my blog: Deploy Happiness

    Thursday, August 4, 2016 6:47 PM
  • I am starting to build the infrastructure around Windows 10, but my environment is still all Windows 7 and a few XP machines.

    I need to import the Windows 10 ADMX files into the central store so that I can begin to work on the policies to control Windows 10.  I am worried about what will happen to the Windows 7 settings in my policies.

    Updating/changing ADMX files (or, even deleting ADMX files), has *zero* affect on existing GPOs... None at all...

    Your existing GPOs will continue to be applied/processed exactly as before.

    ADMX/ADML files are Templates - templates are used for display purposes, and only within the GPMC/GPME and the GPresult/RSoP toolsets - templates are not used in any way during the apply/processing of a GPO.

    If you do add/remove/update template files, either in a local template store (c:\windows\policydefinitions\) or in the CS, those toolsets mentioned above will reflect your template file changes. In doing that, the toolsets will follow the directives in the template files, i.e. will not show settings, or will show changed settings, etc.

    The *settings*, are what you *can* set ------ the *values*, are what you *have* set...
    e.g. "set the proxy" is a setting... proxy=http://squid01.contoso.com, is the value of that "set the proxy" setting....
    Updating/changing templates will *not* modify that *value*, but, a newer template *might* no longer have that *setting*, which would mean that once the newer templates are placed in the local or central store, the toolsets won't display or allow a way to view/set/edit/remove that particular *setting*.

    As Joseph mentions, one of the most notable changes introduced was the deprecation of the old IEM settings. This was actually deprecated in IE10: https://technet.microsoft.com/en-au/library/jj890998.aspx and carried forward since then. IEM is ancient and horrible.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Thursday, August 4, 2016 9:46 PM
  • A related question...

    Do I even need to update the central store if I will run GPMC from the same OS as the one I am trying to manage?

    I mean if I open GPMC from Windows 7SP1, will all the options for Windows 7SP1 be there?

    Similarly, if I do not send the updates for Windows 10 1511 to the central store, can I still use GPMC on a Windows 10 1511 machine to create policies that take advantage of the new stuff while leaving the DCs alone?

    If you have implemented the CS, by default, all computers in the domain will refer to the CS to obtain the template files and so will ignore the local store. There is a registry key to override that, should you need to do so e.g. for a specific computer to use the toolsets with older templates..

    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Thursday, August 4, 2016 9:53 PM
  • I see, so it is all or nothing.  Of course my Chrome and other application based ADMX files are loaded into the CS.  The thing is,  I would like to continue to manage both Windows 7 policies while starting to also develop Windows 10 policies.  This part you mention

    Updating/changing templates will *not* modify that *value*,

    but, a newer template *might* no longer have that *setting*,

    which would mean that once the newer templates are placed in the local or central store,

    the toolsets won't display or allow a way to view/set/edit/remove that particular *setting*.

    That part is a real problem.  It is not as if Windows 7 ceases to exist the day the Windows 10 ADMX files are checked in... And those lost settings may not even be that apparent when setting up new Windows 7 policies after the Win10 ADMX files.  I don't see the reason to remove any settings for a supported OS from new ADMX releases.  They can mark the description as only applies to Win 8 and earlier or whatever, but to remove the setting entirely is beyond reason.  Microsoft should release a suplimental ADMX that restores the Windows 7 settings that were removed from the Win 10 ADMX files  so users can continue to fully manage their still supported OSes.
    Friday, August 12, 2016 4:39 PM
  • I see, so it is all or nothing.  Of course my Chrome and other application based ADMX files are loaded into the CS.  The thing is,  I would like to continue to manage both Windows 7 policies while starting to also develop Windows 10 policies.  This part you mention

    Updating/changing templates will *not* modify that *value*,

    but, a newer template *might* no longer have that *setting*,

    which would mean that once the newer templates are placed in the local or central store,

    the toolsets won't display or allow a way to view/set/edit/remove that particular *setting*.

    That part is a real problem.  It is not as if Windows 7 ceases to exist the day the Windows 10 ADMX files are checked in... And those lost settings may not even be that apparent when setting up new Windows 7 policies after the Win10 ADMX files.  I don't see the reason to remove any settings for a supported OS from new ADMX releases.  They can mark the description as only applies to Win 8 and earlier or whatever, but to remove the setting entirely is beyond reason.  Microsoft should release a suplimental ADMX that restores the Windows 7 settings that were removed from the Win 10 ADMX files  so users can continue to fully manage their still supported OSes.

    Probably %99.99 of the time, settings are added. Rarely, settings are renamed or re-classified. Even more rarely are settings removed.
    So, you'll *almost always* see newer templates for Windows are a superset of a previous template for Windows. A good example of this is the Internet Explorer templates (INETRES). INETRES has grown a lot over IE5-6-7-8-9-10-11 as new features are added to IE and so policy settings are added to the templates so we can manage those new settings.

    But Office is very different. For each version of Office (2003-2007-2010-2013-2016) there is a different set of templates and each template is *almost exclusively* specific to features/settings of that particular Office version.
    *almost exclusively.. because there is some settings overlap which is either common to multiple versions of Office, or, the setting is actually offered via Office templates but is actually setting something in Windows which affects the Office integration to Windows*


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Saturday, August 13, 2016 8:34 AM
  • The only issue that I'm aware of with the newer ADMXs is related to the depreciated GP extension: IE Maintenance. Machines running IE11 lose the ability to manage those old settings.

    Actually, IEM doesn't use ADMX at all, it never did.
    Nor did IEM use ADM.
    IEM and ADMX are completely unrelated.

    (not that it affects the outcome in any way, just a technicality ;)


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Saturday, August 13, 2016 8:41 AM
  • Related question.  Which is the better/faster method of setting GPOs when you need to manage Windows 10 and Windows 7?  Is it faster to have separate policies for each OS and WMI filter the GPO to the appropriate OS, or is it faster to apply a unified OS GPO that could have several "Win10 Only" policies apply unnecessarily to Windows 7 clients.  Of course Win 7 will ignore those policies that are Win 10 only, but  I've thought that speed at with policies apply is proportional to the number of items that are configured in the policies.   I wonder how many useless items would need to try to apply to Windows 7 before it was better/faster to do a WMI filter and maintain separate Win 7 and Win 10 policies.
    Monday, August 15, 2016 8:17 PM
  • Related question.  Which is the better/faster method of setting GPOs when you need to manage Windows 10 and Windows 7?  Is it faster to have separate policies for each OS and WMI filter the GPO to the appropriate OS, or is it faster to apply a unified OS GPO that could have several "Win10 Only" policies apply unnecessarily to Windows 7 clients.  Of course Win 7 will ignore those policies that are Win 10 only, but  I've thought that speed at with policies apply is proportional to the number of items that are configured in the policies.   I wonder how many useless items would need to try to apply to Windows 7 before it was better/faster to do a WMI filter and maintain separate Win 7 and Win 10 policies.

    http://evilgpo.blogspot.com.au/2014/11/showdown-wmi-filter-vs-item-level.html

    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Monday, August 15, 2016 9:01 PM