[gptalk] Re: How to test new ADMX files

  • From: "Alan & Margaret" <syspro@xxxxxxxxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Fri, 18 Jul 2008 10:50:09 +1000

Hi Darren,


Your assumption is correct. It does ignore it and doesn't give an error
message. Still, it is a rather messy solution. if you want to replace an
ADMX file, you have to make it unreadable  to the tester and the new version
readable only by the tester. And you are still changing security on a
production system. With ADM files I was always able to convince Managers
that it was safe to create a new GPO to test in, set the APPLY security so I
was the only one to receive it and give me WRITE access to the Policy. Now I
need them to fiddle security in the PolicyDefinitions directory as well.


Maybe I need a test domain. But I would love a registry key to point me to a
different PolicyDefiniton Directory..


Alan Cuthbertson



From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Darren Mar-Elia
Sent: Friday, 18 July 2008 9:29 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: How to test new ADMX files



How about permissioning the test ADMX file in the central store such that
only a couple of test administrators can read it? If it can't be read, I
would presume that GP Editor would simply not try to load it?




From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Alan & Margaret
Sent: Thursday, July 17, 2008 4:18 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] How to test new ADMX files


All (especially Darren!)


I am trying to work out how to test ADMX files when I have a Central
repository in place. I cannot work out a way to do this without putting the
entire domain at risk.


Once you have created the Central repository, all users on the domain use
it. I cannot see any way to point them back to the local copy under Windows
or to any other location.


I had thought I could use GPEDIT to edit my Local Policy and (hopefully)
pick up the local ADMX files. But GPEDIT doesn't support ADMX files and GPME
only supports GPO's and always looks at the Central repository if it is


The only options would seem to be:-

*         Have a separate domain for the testing (an overkill if it is just
to test the ADMX files)

*         Don't use the central repository, just the local directory for all
users (A maintenance nightmare)

*         Assume that the ADMX file will have no syntax errors and just
throw it in. 


Admittedly the last option is not as bad as you may think. If it is wrong it
will only impact users trying to edit Admin Template entries and it can be
easily reversed.  However most managers like to have change control on such



Alan Cuthbertson



Other related posts: