Finding customised ADM templates in AD

Customised ADM files can be used to manage registry stamping, controlled through standard Group Policy Objects. Due to the nature of how these template values are stored, and combined with standard sysvol Group Policy structure, it's not always to find templates, policies and what settings will be applied. This post provides several command-line methods.

Find customised policies. These ADM files are replicated throughout the domain and are considered authoritative:

1. dir \\%fqdn%\sysvol\%fqdn%\*.adm /s
2. dir \\test.com.au\sysvol\test.com.au\*.adm /s/b find /i /v "wuau.adm" find /i /v "system.adm" find /i /v "wmplayer.adm" find /i /v "inetres.adm" find /i /v "conf.adm"

Query AD to match the GPO GUID to the display name:

1. dsquery * "CN=Policies,CN=System,DC=domainRoot" -filter '&(objectCategory=groupPolicyContainer)(cn=%GUID%)' -attr Name displayName
2. dsquery * "CN=Policies,CN=System,DC=domainRoot" -filter "&(objectCategory=groupPolicyContainer)(cn={F0A33B85-963E-4dF5-A425-E6E0894732DB})" -attr Name displayName

Add a custom ADM using GPMC:

1. Use GPMC to edit the GPO
2. Select the Administrative Templates, right-click, select 'Add/Remove Templates'
3. Select the local copy of the customised ADM file
4. This copies the adm file to the GUID GPO in the replicated sysvol area. (eg. file://dc.test.com.au/sysvol/test.com.au/Policies/%7BF0A33B85-963E-4dF5-A425-E6E0894732DB%7D/adm/Test.adm)
5. Clear the 'Only show policy settings that can be fully managed' setting in View - filtering
6. Navigate to the hierarchy added through the ADM
7. Enable settings as appropriate

View the registry settings that will be applied as part of a GPO:

1. Find the registry.pol for the GPO, see the commands above.
2. regview Registry.pol

Notes:

1. This should first be performed in a test-lab environment, before adding the ADM to the production sysvol area.
2. These settings are not visible by default, as GPMC hides policy settings that cannot be fully managed. To change, Computer Configuration or User Configuration Administrative Templates View Filtering 'Only show policy settings that can be fully managed' unticked.
3. Customised template settings to not show up in the 'Settings' tab of GPMC
4. Regview.exe can be found in the Windows Server 2003 Deployment Kit

Wayne's World of IT (WWoIT), Copyright 2008 Wayne Martin.