: Windows Server 2008 and Windows Vista : Administrative (.adm) Templates (part 5) - Policies vs. Preferences

7. Policies vs. Preferences

Policies are registry-based settings that can be fully managed by administrators and Group Policy. These are also referred to as true policies. In contrast, registry-based settings that are configured by users or are set as a default state by the operating system at installation are referred to as preferences.

True policies are stored under approved registry keys. These keys are not accessible by users, so they are protected from being changed or disabled. The four approved registry keys are shown in Table 3.

Preferences are registry-based settings that are located in registry keys other than the approved registry keys listed in Table 3. Users can typically change their preferences at any time. For example, users can decide to set their wallpaper to a different bitmap. Most users are familiar with setting preferences through the operating system or application user interface.

You can create custom .adm templates that set registry values outside of the approved registry keys. When you create these preferences, you only ensure that a given registry key or value is set in a particular way. These preferences are not secured as true policies are; users can access these settings and modify them. Another issue with preferences is that the settings persist in the registry. The only way to alter preferences is to configure them using the .adm template or manually update the registry.

In contrast, true policy settings have access control list (ACL) restrictions to prevent users from changing them, and the policy values are removed when the GPO that set them goes out of scope (when the GPO is unlinked, disabled, or deleted). For this reason, true policies are considered to be policy settings that can be fully managed. By default, the GPME shows only true policy settings that can be fully managed. To view preferences in the GPME, you right-click the Administrative Templates node, click View, click Filtering, and then, in the Filtering dialog box, clear the Only Show Policy Settings That Can Be Fully Managed check box.

True policy settings take priority over preferences, but they do not overwrite or modify the registry keys used by the preferences. If a policy setting is deployed that conflicts with a preference, the policy setting takes precedence over the preference setting. If a conflicting policy setting is removed, the original user preference setting remains intact and configures the computer.

8. ADMX Files

ADMX files have replaced .adm templates in Windows Vista and Windows Server 2008. The purpose and result of the ADMX files are the same as the .adm templates, which is to provide an interface within the Group Policy Management Editor (GPME) so that registry-based settings can be configured. From a GUI experience, administration of a GPO will not be altered when using ADMX files compared to .adm templates.

The reasons for the change of file format, structure, and architecture are numerous. The legacy .adm templates were powerful and manageable, but limitations and negative behavior spurred the change to the ADMX file format. Some of the benefits of ADMX files include:

• Multiple language support

• Elimination of SYSVOL bloat

• Utilization of a central store

• More control over ADMX file versions

• Centralized management of default and custom ADMX files

Warning

9. Default ADMX Files

Every installation of Windows Vista and Windows Server 2008 includes a complete set of ADMX files. These files create the two Administrative Template nodes under Computer Configuration and User Configuration in the GPME. There are 132 default ADMX files for Windows Vista and 146 default ADMX files for Windows Server 2008 and Windows Vista SP1. Each ADMX file has an associated ADML file located under one or more language-specific folders, such as EN-US for English.

The location of the default ADMX files is %windir%\PolicyDefinitions. There is only one default language-specific subfolder in this main folder, which is English in most cases.