[gptalk] Re: Complete list of all available CSEs and their functionality

  • From: "Hendrikus Terwint \(SEDIRSI-Prestataire\)" <terwint.hendrikus.prestataire@xxxxxxxxxxxxxxxxxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Wed, 16 Apr 2008 19:08:12 +0200

Thanks much, Thorbjörn. 


In terms of GP Performance Optimization (related to CSE processing), I'm a bit 
confused now. Having read Darren's "Design Recommendations for Optimal GP 
Performance" in:



- the fact that there is no concept of per-CSE versioning within Group Policy 
processing :


"... If you are making frequent changes to your GPOs, keep in mind the effect 
mentioned earlier, where a change to one CSE can impact the processing of all 
CSEs. To that end, if you plan to make frequent changes to, for example, 
registry policy, it makes more sense to put your registry policy into 
functional GPOs (GPOs that only do registry policy) as that will isolate other 
CSEs from processing when changes occur."


à In Darren's example above, the so called "registry policy" could be anything?

à It now seems to me that the "Registry CSE" is almost always involved anyway. 
Does it still make sense to analyze my GPOs on a CSE-base and split them up? 
Maybe it's worth to figure out which CSEs do not depend on the Registry CSE, so 
we can at least configure them ("Scripts" ? "Folder Redirection"?

 "Software Installation"?) in separate GPOs, in order to avoid other CSEs to be 
"woken up" when changes occur in settings processed by, lets say, 
"independent-CSEs"? However, these settings don't change that often in our 
environment... Maybe the kind of GP Performance Optimization as mentioned in 
the article above would only "really" be true if there were many more CSEs than 
just the 12 CSEs (which is the number of CSEs I've got currently) ? Maybe it's 
because there will be many more CSEs with GP Preferences installed?


Thanks again very much for your explanation!





De : gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] De la 
part de Thorbjörn Sjövold
Envoyé : mercredi 16 avril 2008 17:49
À : gptalk@xxxxxxxxxxxxx
Objet : [gptalk] Re: Complete list of all available CSEs and their functionality




the Registry CSE is pretty much the descendant of the old NT 4 policies, it has 
GUID {35378EAC-683F-11D2-A89A-00C04FBBCFA2} (and is listed but no settings), it 
is very special and not a "true" CSE to 100%, for example when you register 
your own CSE, you can say that it should only process if the Registry CSE 
successfully executed etc. But to sum up it is the CSE that is responsible for 
anything under Administrative Templates, i.e. ADM/ADMX. Also a number of other 
extensions rely on the Registry CSE, for example the Software Restriction 
Policy as far as I recall, that in reality adds settings that the Registry CSE 
will manage but from its own GPOE snap-in.




Thorbjörn Sjövold

Special Operations Software


thorbjorn.sjovold a t specopssoft.com


Download our free tool for remote Gpupdate with graphical reporting, 







From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On 
Behalf Of Hendrikus Terwint (SEDIRSI-Prestataire)
Sent: den 16 april 2008 17:31
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: Complete list of all available CSEs and their 


Thanks a lot for your quick reply, Darren, as well as Thorbjörn.


I'm not quite sure though if I understand what you both mean by "Registry CSE". 
I guess you mean it's not one of the CSEs listed in my GPExtensions registry 
key? (I'm not sure whether there is one main "registry" CSE with some 
additional CSE extensions, or if the "registry CSE" is just one of those/ any 
of those extensions we can find under HKLM\Software\Microsoft\Windows 


I'd like to optimize our GPOs, i.e. per GPO only add settings that are 
processed by a single CSE. (Goal: if the GPO version is incremented, have only 
CSE x update its list, and not CSE y)


You are right Darren: the GPExtensions list is pretty straightforward, but they 
only cover a small percentage of the overall settings. If the "Registry CSE" 
does most everything, I'm wondering if my "optimization" would make sense....





De : gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] De la 
part de Darren Mar-Elia
Envoyé : mercredi 16 avril 2008 16:03
À : gptalk@xxxxxxxxxxxxx
Objet : [gptalk] Re: Complete list of all available CSEs and their functionality



Frankly the most definitive list of CSEs will be on the machine of the most 
recent version of Windows you are running, in the registry under 
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions. 


In terms of which settings are processed by which CSEs, this is not completely 
straightforward but, for example, most everything under Administrative 
Templates is processed by the Registry CSE and then the rest of the CSEs are 
pretty self-explanatory. But I don't think you will find a definitive list of 
which CSE processes every setting.






From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On 
Behalf Of Hendrikus Terwint (SEDIRSI-Prestataire)
Sent: Wednesday, April 16, 2008 6:39 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Complete list of all available CSEs and their functionality


Hello everybody,


Is there a way to determine which GP setting is processed by which CSE ?


I have found a list of default Client-Side Extensions on Technet:



However, I'd like to see a complete list, just like the "Group Policy Settings 
Reference" on windows.com/downloads, with a column that says which CSE is 
responsible for processing which setting.


For example: if we use the DFS.admx to change the DFS network policy. Is there 
a DFS CSE that processes this policy, or is it processed by one of the default 
CSEs? Does it require an extension at all? Maybe the CSE list on the link above 
is quite complete, and all other settings are processed by the Group Policy 
Engine itself?


Is there such list around somewhere? (that links every possible GP setting to 
the GP Engine or CSE component that processes this setting)


Many thanks in advance,


Hendrikus TERWINT

Consultant Avanade France



Prestataire pour le compte de SEDI-RSI, site de Bagnolet

Tél. : 01 55 82 39 70


Other related posts: