WindowsDevCenter.com
oreilly.comSafari Books Online.Conferences.

advertisement


AddThis Social Bookmark Button

Understanding Administrative Templates

by Mitch Tulloch, author of Windows Server Hacks
03/01/2005

In a previous article of mine, I extolled AutoProf Policy Maker as a cool tool for extending the power of Group Policy. The tool lets you do many things that otherwise require a combination of Group Policy and custom scripts, and it also lets you deploy Registry changes to remote machines faster and more easily than by Microsoft's traditional approach of creating custom administrative templates. However, there are some situations where administrative templates are the best or most obvious approach, so let's dig into how they work and see what you can do with them. A quick side note before we get started, though: AutoProf has just changed its company name to DesktopStandard, and you can now find info about Policy Maker versions on the PolicyMaker Overview page.

Administrative templates are a key component of Group Policy on Windows 2000, Windows XP, and Windows Server 2003. These templates are Unicode-formatted text files with the extension .adm and are used to create the Administrative Templates portion of the user interface for the Group Policy Object Editor as shown in Figure 1.

Figure 1
Figure 1. The Administrative Templates portion of the Group Policy Object Editor interface is created by installed administrative template (.adm) files

Using the two Administrative Template sections of the Object Editor, you can deploy modifications to machine (HKLM) and user (HKCU) portions of the Registry of computers targeted by your Group Policy Object (GPO). All you need to do is link your GPO to the appropriate site, domain, or organizational unit (OU) and let Group Policy processing do its thing. Note that the administrative templates (.adm files) do not themselves modify the Registries of target computers--all they do is create the GUI elements in the Object Editor that let you configure Registry settings for computers targeted by your GPO.

The power of administrative templates becomes obvious in the fact that there are now more than 1,300 different Registry settings you can configure using them. These settings range from configuring network settings to locking down users' desktops to configuring how Group Policy itself works. To use an administrative template, you first have to install it using the Object Editor; there are several templates installed by default, as we'll see in a moment. You can also download additional templates for some Microsoft applications, and even create your own template from scratch if you need to.

Standard Templates

The standard administrative templates are found in the %windir%\inf folder on your machine, and the ones that are installed by default depend on the operating system version you are using. Table 1 gives a quick summary of the templates that are installed by default on different OS versions.

Template

OS versions

Description

Conf.adm

2000/XP/2003

Displays policy settings for configuring Microsoft NetMeeting

Inetres.adm

2000/XP/2003

Displays policy settings for configuring Microsoft Internet Explorer

System.adm

2000/XP/2003

Displays policy settings for configuring core OS GUI features

Wmplayer.adm

XP/2003

Displays policy settings for configuring Windows Media Player

Wuau.adm

2000SP3/XPSP1/2003

Displays policy settings for configuring automatic updates

Table 1. Default administrative templates

In addition to the above templates, which are installed by default on the platforms indicated, there are some other templates in %windir%\inf that are there for you to install if you need them. These are summarized in Table 2.

Template

Description

Common.adm

Displays policy settings that are in common with Windows 9x/NT (used with System Policy Editor poledit.exe)

Inetcorp.adm

Displays policy settings for configuring dial-up, language, and Internet Explorer temporary files

Inetset.adm

Displays additional policy settings for configuring Internet Explorer

Windows.adm

Displays policy settings specific to Windows 9x (used with System Policy Editor poledit.exe)

Table 2. Other standard administrative templates

More Templates

We'll see how to add and remove templates (and what this does in the Object Editor GUI) in the next article. But first, if you are a Microsoft shop, a whole bunch more templates are available to let you manage business productivity applications on your network using Group Policy. First, let's look at the templates available for Microsoft Office 2003 (see Table 3). These templates are available from the Office 2003 Resource Kit and give you a lot of control over Office applications deployed in a managed environment (that is, a Group Policy environment).

Template

Description

Aer_1033.adm

Displays policy settings for configuring Application Error Reporting

Access11.adm

Displays policy settings for configuring Microsoft Access 2003

Dw20.adm

This was an earlier template for configuring Application Error Reporting and has been replaced in Office 2003 by Aer_1033.adm

Excel11.adm

Displays policy settings for configuring Microsoft Excel 2003

Fp11.adm

Displays policy settings for configuring Microsoft FrontPage 2003

Gal11.adm

Displays policy settings for configuring Microsoft Clip Organizer

Inf11.adm

Displays policy settings for configuring Microsoft InfoPath 2003

Instlr11.adm

Displays policy settings for configuring Microsoft Windows Installer

Office11.adm

Displays policy settings common to all Office 2003 components

Onent11.adm

Displays policy settings for configuring Microsoft OneNote 2003

Outlk11.adm

Displays policy settings for configuring Microsoft Outlook 2003

Ppt11.adm

Displays policy settings for configuring Microsoft PowerPoint 2003

Pub11.adm

Displays policy settings for configuring Microsoft Publisher 2003

Word11.adm

Displays policy settings for configuring Microsoft Word 2003

Table 3. Office 2003 administrative templates

You'll also find updated templates for Office 2003 Service Pack 1 available here from the Microsoft Download Center. Earlier versions of Office also have their own set of templates you can use to configure them using Group Policy.

Still More Templates

There are still more templates available if you need them. For example, in the Windows Server 2003 Resource Kit Tools you'll find Inetesc.adm, which displays policy settings for the Microsoft Internet Explorer Enhanced Security Configuration in Windows Server 2003.

The Microsoft Download Center is also a great place to check if you need the latest templates to go with your particular platform-cum-Service Pack combination. You can get the latest download of Group Policy ADM files if you need it.

So now that you're almost swimming in a sea of administrative templates, what can you actually do with them? I'll talk about that in my next article.

Mitch Tulloch is the author of Windows 2000 Administration in a Nutshell, Windows Server 2003 in a Nutshell, and Windows Server Hacks.

Windows Server Hacks

Related Reading

Windows Server Hacks
100 Industrial-Strength Tips & Tools
By Mitch Tulloch

Return to the Windows DevCenter.