Using Custom ADM Templates with Windows Server 2008/Vista/7
There are numerous companies out there that have developed custom ADM templates to handle their hard to reach Registry settings. These custom ADM templates were necessary because Microsoft did not, and could not, include all Registry settings in the default Group Policy Object (GPO) settings. These ADM templates have been around for a long time and now that Windows Server 2008, Vista, and 7 do not use ADM templates, I often get questions asking me what will happen with the custom ADM templates. In this article I will briefly describe what an ADM template does, then describe how you will move forward with these custom templates in your new Windows Server 2008/Vista/7 environment.
What Does a Custom ADM Template do?
An ADM template is a file that is designed to be used within Group Policy to define a Registry setting and its’ value. There are 5 default ADM templates that come with Windows Server 2003 and XP, but these files can only handle so many Registry settings. If you want to have more Registry settings available in your GPO, then you have an option of creating a custom ADM template.
A custom ADM template (or a standard one for that matter) is responsible for doing two things. First, it is responsible for defining what will be changed in the Registry. We are all familiar with the Registry by now, I hope! The Registry is broken down into two parts for what ADM templates are concerned: HKEY_LOCAL_MACHINE (HKLM) and HKEY_CURRENT_USER (HKCU).
The ADM template will define the path in the Registry, the value within that path, and the data (or set value) that the value can and will be set to.
The custom ADM template also establishes the folder(s) and policy within the GPO. If the Registry value falls under HKLM, then the policy will be located under Computer Configuration\Policies\Administrative Templates and if the value falls under HKCU the policy will be located under User Configuration\Administrative Templates when you edit the GPO to find the setting. Figure 1 illustrates that a custom ADM template entry might look like.
Figure 1: Custom ADM template entry in the GPO editor
If you are looking at a GPO on Windows Server 2008/Vista/7, then you will also have a Policies folder before the Administrative Templates folder in the GPO editor.
How do you Include Custom ADM Templates in Windows Server 2003/XP and before?
When a custom ADM template was added to a GPO in the past, the ADM template was added through the GPO editor. Because ADM templates only control the Administrative Templates portion of the GPO, this is where you go to add in any custom ADM templates.
In order to add a custom ADM template, you right-click on the Administrative Templates node (you can select either the one under Computer Configuration or User Configuration, it does not matter for the importing of the ADM template), then select the Add/Remove Template option, as shown in Figure 2.
Figure 2: Adding Custom ADM templates to a GPO
If there are no errors in the custom ADM template syntax, the new setting will just appear in the editor. If there are errors, and there will typically be an error message that will not allow the file to be imported until the error is corrected.
Where are Custom ADM Templates Stored?
ADM templates are all stored with the GPO settings on the domain controllers. The location for these files is in the default path of c:\Windows\Sysvol\sysvol\<domainname>\Policies\<GUID of GPO>\ADMs. Here, you will find the default 5 ADM templates, as well as any custom ADM templates that you have imported into the GPO.
Custom ADM templates are associated with only the GPO that imported it. If you want an ADM template to be available for multiple GPOs, you must import it into each GPO individually, thus creating multiple copies of the ADM file in each GPOs storage folder in sysvol.
Windows Server 2008/Vista/7 and Administrative Templates
Microsoft made a radical change from ADM templates to ADMX/ADML files when they released Windows Vista and Windows Server 2008. There are no ADM templates on either of these operating systems. The role of the ADMX/ADML is identical to that of the ADM template, it is just that each responsibility of the ADM template is now broken such that the ADMX file is responsible for one task, where the ADML file is responsible for the other.
ADMX files are responsible for defining the Registry portion of the GPO setting. These files are not language specific, in that they come in English only.
ADML files are language files and are responsible for creating the folder and policy structure in the GPO editor. This allows for many languages to be supported, where ADM templates only supported English.
Be default, ADMX/ADML files are obtained from the local computer where the GPO is being administered. If you create a central store, http://www.windowsecurity.com/articles/Managing-Windows-Vista-Group-Policy-Part1.html, then you have all Windows Server 2008/Vista/7 computers using a single version of the ADMX/ADML files.
Be sure to update the central store with Windows 7 or Windows Server 2008 R2 ADMX/ADML files once you get one of these operating systems on your network. There are changes to the files that you will want all computers taking advantage of.
Having Custom ADM Templates with Windows Server 2008/Vista/7
Since Windows Server 2008/Vista/7 do not use ADM templates, what would happen when you try to mix custom ADM templates and ADMX/ADML files? The answer is very simple!
The ADMX/ADML files will generate the default GPO settings that fall under Administrative Templates. The custom ADM templates that reside in the ADMs folder under the GPOs sysvol location will show up under the Classic Administrative Templates (ADM) folder, which is located under the Administrative Templates nodes in the GPO editor. You can see an example of this in Figure 3.
Figure 3: You can clearly see custom ADM templates show up under Classic Administrative Templates (ADM) in the editor
There has been a change from ADM templates to ADMX/ADML files in Windows Server 2008/Vista/7. This change could have an impact on your custom ADM templates, if you are not aware of the overall big picture of the changes. Keep in mind that ADM templates are no longer used, but are instead replaced by ADMX/ADML files in the creation of the Administrative Templates nodes in the GPO editor, as well as the definition of the Registry entry that will be altered. Custom ADM templates are stored in the GUID folder of the GPO that they are associated with, regardless of the version of the OS that is performing the administration of the GPO. It is this structure and the ability of the newer OSs that provide the cohabitation of the newer files along with the custom ADM templates. Just keep in mind that the custom ADM template settings will show up under the Classic Administrative Templates (ADM) folder.