Hello, Cloud Gurus, and welcome back.
For this lesson,
we're going to take a look at how you can
leverage Group Policy Administrative Templates.
Let's take a look at what we're going to cover.
First up, we'll cover the fundamentals
of Group Policy Replication
because it's important to understand that
before we take a look at Administrative Templates.
Then we'll cover off Administrative Templates
and how you can use those
to extend the functionality provided by Group Policy.
And then we'll wrap up with a demo
where we will Configure a Central Store
for our Administrative Templates.
All right, let's get started.
Group Policy data is stored
in 2 locations on domain controllers.
Firstly, the details about the GPOs
is stored in the Group Policy container
in the Active Directory Database
and it stores Group Policy Object metadata.
It's important to know that this doesn't contain settings.
The Group Policy container
in Active Directory Domain Services,
replicates by the Active Directory Replication Agent.
The second component is the Group Policy Template
which is a collection of files
stored in the SYSVOL folder of each domain controller.
And the Group Policy Template in the SYSVOL folder,
replicates using Distributed File System replication.
And because these two components are replicated separately,
there may be instances where one replicates
to a domain controller before the other,
usually when metadata is replicated,
but the template has not,
usually due to the largest size of the template.
This can lead to errors in refreshing
in applying Group Policy on Group Policy clients,
but this is usually temporary.
But that's not the entirety of the Group Policy information
that's stored in SYSVOL.
Let's take a look at what else is stored in SYSVOL.
Administrative Templates allow you
to extend the functionality of Group Policy
with additional registry-based settings.
The default set of Administrative Templates
is available on every Windows PC
where the Group Policy Management Tools are installed
and IT admins can create or download
new Administrative Templates
to extend Group Policy functionality.
The Administrative Templates are used to modify registry
settings on the target computer.
An Administrative Template is made up of 2 parts:
the ADMX file,
which contains the registry configuration information,
and the ADML file, which contains descriptions
in a specific language.
If an administrator downloads and stores
the Administrative Templates
on the Administrative Workstation
and uses those templates to create a GPO.
Other administrators might receive errors
if they do not have
the matching Administrative Templates installed.
To get around this limitation,
you can configure a Group Policy Central Store in SYSVOL.
When administrators use Group Policy tools
to edit Group Policy where a Central Store is configured,
all ADMX and ADML files are read from the Central Store
and that Central Store is replicated
with the SYSVOL folder.
To create a Central Store,
you create a policy definitions folder in SYSVOL
and copy all of the ADMX and ADML files
from an existing Windows PC to that directory.
You will need to update the Central Store periodically
as software and operating system updates
are released to enable your teams
to configure settings using the latest versions
of the software and the applications.
All right, let's take a look at a demo
of configuring the Central Store.
In this demo, we will extend the functionality
of Group Policy to allow us to configure
and manage the Microsoft 365 Suite of software
by downloading the Microsoft 365 Administrative Templates
to our Administrative Workstation.
Then we will create a Central Store
by creating a policy definitions folder
in the SYSVOL directory on our domain controller.
And then we will copy all of the ADMX and ADML files
from our Administrative Workstation to the Central Store.
Now we need to be an administrator
in our domain to complete this.
Let's take a look.
All right, so here we are logged onto
our administrative server and I've gone ahead
and downloaded the Microsoft 365 Administrative Templates.
I'll just quickly launch Edge to show you
where I downloaded that from.
So Microsoft provides a website where you can download
the ADMX and ADML files for your Microsoft 365 apps.
And then you can go ahead and click Download
and then you can select
whether you're downloading the 64-bit version
or the 32-bit version.
I'll go ahead and close this.
And I've downloaded that installer to the downloads folder.
So we'll launch Windows Explorer
and then we'll launch
the Administrative Templates installer.
Accept the software license terms
and then click Continue.
It'll ask me where I want to put the templates.
Now it's a good idea to put the templates
in a different location to where you actually
intend to put them.
So I'm going to go ahead and create a folder on the desktop.
Just select desktop and then make new folder.
I'll just create an M365 folder,
and then we can go ahead and click OK.
It'll extract those files.
And then we can go ahead and click OK.
Now I'm going to copy the Administrative Templates
to my computer so that I can view the settings
that are available in these Administrative Templates.
To do that,
I'm going to navigate to system root
and then policy definitions.
And then I will also navigate to the Microsoft 365
folder where I extracted the templates to.
And now we can navigate into the ADMX folder
and then we can copy out the ADMX files
and our language ADML files.
So I can copy that
and then paste that
into my C Windows Policy Definitions folder.
And just go on ahead and pasted the ADMX files.
And it's also merged the ADML files
into the en-US folder.
Let's go ahead and launch Group Policy management
and take a look at these new settings.
So I'll click Start and then Windows Administrative Tools.
Then I'll open Group Policy Management
and then we'll just expand out our domain
and we'll edit the Default Domain Policy.
And then we will navigate
to policies and then Administrative Templates.
And I'll just expand this left pane out a little bit here.
And we can see here that we have the Microsoft 365
Administrative Template settings.
And we can see that the ADMX files
are being retrieved from the local computer.
Now this is useful for me
but this won't be useful for other administrators
that need to edit this Group Policy Object.
So we'll go ahead and close this.
And then we'll minimize Group Policy Management
and Administrative Tools.
Then let's go ahead and create a Central Store.
So to do that,
we need to navigate to the SYSVOL folder in our domain.
So I'm going to use this left hand-window here
and we'll navigate to corp.barrierreefaudio.com
and then SYSVOL.
Navigate to our domain folder
and then we'll navigate to the policies folder.
And then we need to create a new folder in here
called policy definitions.
So I'll go ahead and right click, New Folder,
and we'll name this folder PolicyDefinitions.
And then OK.
And then into this folder
we need to copy across all of the ADMX files and ADML files
from a Windows computer.
So I'm going to go ahead and copy across all of these files.
We'll paste them in the Central Store.
So that includes all of the default ADMX files
and the additional ADMX files that we've downloaded
like the Microsoft 365 Administrative Templates.
All right, now let's go ahead
and open Group Policy Management again
and then we'll edit the default domain policy.
And then we'll navigate into policies again.
And then Administrative Templates.
Takes a second.
And we'll just expand out that left pane again.
And we can see here, we have the Microsoft 365 settings
and all of the default settings
and that the ADMX files are being retrieved
from the Central Store.
All right, that concludes this demo.
Let's take a look at what we've covered in this lesson.
You can create a PolicyDefinitions folder
in your SYSVOL directory
to create a Group Policy Central Store
for your Administrative Templates.
And Microsoft and third-party vendors provide ADMX
and ADML files that you can copy to the Central Store
to extend Group Policy functionality.
And all of the ADMX and ADML files must be copied
from the most recent Windows computer in your environment
to the Central Store when you create the Central Store.
All right, that concludes this lesson.
Thanks for being with me.
And I hope you found it useful.
And I look forward to seeing you on the next lesson.