RE: [ActiveDir] Distributing Administrative templates

[Abbiss, Mark]

Title: Message

Many thanks for the information and pointers. Having read them, can someone then tell me if I have got this correct.....

 

If I copy the latest ADM files to one of my DC's (In my case my local site DC, which has no FSMO roles) and then create a new GPO and assign it to an OU, the following statements will be true :-

 

1. A new policy object will appear under the SYSVOL directory on my DC

2. The ADM files used by the GPO will be stored in the ADM subdirectory of the GPO

3. The final GPO will then be replicated around the domain to all other DC's

4. The locally stored versions of ADM files held on each DC in the %systemroot%\INF directory, will have no bearing on how the GPO will be processed, as the ADM files located in the SYSVOL structure will be used during GPO processing.

 

Therefore, I do not need to ensure that identical versions of the ADM files exist on all DC's in the domain ?

 

Many thanks for the help,

 

Mark

-----Original Message-----
From: Ruston, Neil [mailto:[EMAIL PROTECTED]
Sent: Montag, 13. Dezember 2004 12:06
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] Distributing Administrative templates

I find the following approach works for me:

 

1. Keep a master copy of all ADM files on a server which is backed up regularly

2. When an ADM is to be altered, alter the master copy and then copy it to a folder on a DC (ideally the same DC each time for consistency - let's say the PDCe)

3. Edit the GPO on the PDCe [where the ADM is used] and remove the old version, then add the new version. (I use version numbers within the file names)

4. Make any necessary changes to the new ADM settings and close the GP editor (thus saving the changes)

 

This new ADM will be replicated to all DCs (via SYSVOL/FRS replication) and all clients will apply the changes when they next refresh their GP settings (every 60 mins for servers/workstations and 60 mins for DCs) assuming their 'local' DC has received the changes via FRS.

 

WRT the relationship between ADMs and GPOs - think of the ADMs as supplying the supported settings to each GPO. If you need to add a new setting (not supported out of the box) you could add the setting to an existing ADM or (preferred) create a new ADM and add that to the GPO. 

 

HTH,

neil

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Abbiss, Mark
Sent: 13 December 2004 10:39
To: '[EMAIL PROTECTED]'
Subject: [ActiveDir] Distributing Administrative templates

I have been searching around for a clear and definitive explanation of how to replicate updated ADM files around my Windows 2003 domain.

 

I an currently trying to update my ADM files to the latest version so that I can support a roll-out of Windows XP SP2. However, I cannot remember or find instructions explaining how I achieve a replication of these files around all my domain controllers.

 

As I understand, the SYSVOL folder is automatically replicated around the domain but the ADM files are held in the %systemfolder%\INF directory.

 

Am I misunderstanding the basic idea ? If I update one DC with the new ADM files (i.e. replace the existing files in the INF directory) and then create on this DC the GPO I need, will the necessary ADM updates be replicated around the domain ?

 

I have to admit to a certain amount of confusion just how ADM files and the GPO fit together. Are the new ADM files needed on all the DC's ?

 

Thanks for any pointers.

 

Mark Abbiss

==============================================================================
This message is for the sole use of the intended recipient. If you received this message in error please delete it and notify us. If this message was misdirected, CSFB does not waive any confidentiality or privilege. CSFB retains and monitors electronic communications sent through its network. Instructions transmitted over this system are not binding on CSFB until they are confirmed by us. Message transmission is not guaranteed to be secure.
==============================================================================