cleitet / wpkg-gp

Running WPKG as a Group Policy Extension
https://github.com/cleitet/wpkg-gp/wiki
25 stars 17 forks source link

ADMX and ADML file should be deployed by the installer #108

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
Wpkg-GP installer 0.17 does not deploy the ADMX administrative template to the 
"Local ADMX Store". Therefore, Wpkg-GP settings cannot be edited using the 
"Local Group Policy Editor" (gpedit.msc)

On Windows Vista+ the files should be deployed by the Wpkg-GP installer to 
these locations:

%WINDIR%\PolicyDefinitions\wpkg-gp.admx
%WINDIR%\PolicyDefinitions\en-us\wpkg-gp.adml

This action should not be done on Windows XP and Server 2003 R2 as they do not 
support ADMX templates, but the older ADM format.

Note 1: EN-US is set as fallback language on non-English Windows. Nevertheless, 
the en-us directory might not exist on these localized versions of Windows, so 
the Wpkg-GP installer should create it in case it does not exist.

Note 2: ADMX Template is a new feature in version 0.17. See Issue 107 for 
further details.

Original issue reported on code.google.com by mgr...@gmail.com on 3 Jun 2014 at 10:05

GoogleCodeExporter commented 9 years ago

Original comment by sao.es...@gmail.com on 11 Jun 2014 at 9:27

GoogleCodeExporter commented 9 years ago
Wpkg-GP installer DOES NOT need to deploy these files on clients.

You don't actually need to deploy ADMX/ADM templates on your client. You deploy 
these files into central store (ADMX) or on computers you use to manage your 
policies (ADM, ADMX in rare configurations).

ADMX and ADM files are not taken into account when APPLYING the policy on the 
client computer. These files are only used when MANAGING the policies - 
gpedit.msc uses these templates to create nice policy tree, entries, 
descriptions and controls.

Once you save your policy, that policy (.pol) bears no information about the 
template that was used to create it. Instead, the policy file stores discrete 
registry settings that are to be applied to clients. Client machine reads that 
file and applies registry changes. 

When you open your policy again to change settings, all registry settings found 
in policy file are loaded and matched against currently available templates - 
to properly display what has been set and how.

Also, Windows XP and 2003 machines do accept ADMX-based policies without any 
real issues. You still need more advanced machine to manage these policies on 
domain level, yes, but on client level they are properly applied on older 
systems.

Original comment by michal.s...@gmail.com on 30 Jun 2014 at 3:55

GoogleCodeExporter commented 9 years ago
Thank you for your reply. Although your arguments are pure facts, I still think 
the Wpkg-GP installer SHOULD deploy the ADMX files.

Although you really do not need the ADM(X) files on regular client computers 
for GPOs to work, they are needed on administrative computers, where policies 
are edited. Actually, even non-administrative computers need the ADM(X) files 
to generate the Resultant Set of Policy (RSoP) report (e.g. by running 
gpreport.exe). And from my experience, not every company that has AD uses the 
ADMX Central Store feature.

As of now, the Wpkg-GP installer allows you to choose from these 3 components 
to deploy:
Wpkg-GP Client
Wpkg-GP Administrative Template for Group Policies
Wpkg-GP MSI tool

When you select the second option, it correctly deploys the old ADM file to 
C:\Windows\INF, but it does not deploy the new ADMX file. Therefore, in my 
opinion, this is a bug and I am not requesting a new feature.

If an administrator wants to deploy policies based on this ADMX template, he 
has to download it manually from GIT and place it either to the Local ADMX 
Store(C:\Windows\PolicyDefinitions) or the Central one (in AD SYSVOL), if the 
company uses this feature. This is not very comfortable. I would expect the 
ADMX file to appear in the Local ADMX Store to be readily usable in Group 
Policy Editor on that machine, or at least in the "C:\Program Files\Wpkg-GP" 
directory.

Original comment by mgr...@gmail.com on 21 Jul 2014 at 4:33

GoogleCodeExporter commented 9 years ago
I agree on this. The installer should deploy the ADMX files on supported 
Windows versions, for better compatibility

Original comment by jorgito1...@gmail.com on 17 Aug 2014 at 5:48

GoogleCodeExporter commented 9 years ago
This is in fact a bug as the Wpkg-GP 0.17 installer still deploys the old 
wpkg-gp.adm file.

I changed this now so the new admx templates are being installed - as this is 
optional to install those templates should it suit both described approaches.

Changes committed and will be released with next release.

Original comment by sao.es...@gmail.com on 18 Aug 2014 at 1:31