The administrative template that you get with Win11 is somewhat out of date, so if you want to manage OneDrive with domain group policy your options are limited, if only there was a newer administrative template!
Well, there is, and it gets updated and sent to you quite regularly. Microsoft just do a good job of hiding it.
Solution OneDrive GPO
Depending on your deployment the files you need can be in different locations, the biggest challenge is finding them. execute the following PowerShell to locate them.
As you can (above) see mine are in my user profile. The folder that they are in will also give you the build number, so you can check occasionally for updates (that will get pulled down when your OneDrive client gets updated).
Go to that directory and you will find the ADMX and ADML files.
Note: For anyone who is not English speaking, there may be a different ADML file in the locale folders you can see above.
Copy the OneDrive.admx file into your PolicyDefinitions folder (if unsure of the path, see below. obviously substitute your own domain name and here I’m on a domain controller so the SYSVOL volume on my local drive).
Now change to the INPUT LOCALE folder (in my case en-US) and copy the OneDrive.adml file into that folder.
Then when you are in the Group Policy Management Editor you will see the updated OneDrive options.
Controlling Microsoft Edge with Group Policy is pretty straight forward, you just need to ensure the msedge.admx and msedgeupdates.admx files have been added to your policy definitions store in the right folders. If you have no idea what I’m talking about, see the following article.
While working in the Group Policy Management tool, upon expanding administrative templates I got this error.
Namespace ‘Microsoft.Policies.WindowsStore’ is already defined as the target namespace for another file in the store.
Solution: Microsoft.Policies.WindowsStore Error
This is because in your policy definitions there are two (four actually) files that are pointing to the same thing, and it’s not sure what to do. For central policy each “set of settings’ needs a setting file (ADMX) and a language file (ADML). there used to be one called WinStoreUI, and it was superseded (with an update) by WindowsStore.
The problem is the old WinstoreUI file is still in the definitions folder and both old an new are being read. You can safely ignore the error popup, but it will bug you every time you open administrative templates.
To demonstrate, two ADMX files.
And two ADML files.
Note: ADML files live in the language sub-folder in the policy definitions folder (in my case en-us), if you are elsewhere in the world your locale folder will have a different name).
All you need to do to fix the problem is delete the WinStoreUI files, firstly the WindStoreUI.adml file
Then the WinStoreUI.admx file. Restart the Group Policy management console, and the error should have ceased.
Related Articles, References, Credits, or External Links
In a fit of lunacy Microsoft have called ‘their’ new browser Microsoft Edge, so we can spend the next few months confusing it with Edge. Plus every Google search for GPO settings, error messages etc will all now show search results for the old Edge Browser not the new Microsoft Edge browser! Perhaps the same doofus at Microsoft who called the Exchange sync Active Sync when Microsoft already had a product called Active Sync was involved?
Anyway I got a request from a client this week to have Microsoft Edge on their Citrix environment, there was some confusion (imagine that), because Edge does not work on server 2016, (and it’s not shipped as part of server 2016), but would Microsoft Edge work?
Installing Microsoft Edge on Server 2019/2016 (With IE11)
Why is Internet explorer still alive? Anyway If you want to install Edge on a modern Windows server firstly ensure you are fully up to date with updates! Then open IE. Internet Options > Security > Custom > Scripting > Enable Active Scripting > OK > Yes > Apply > OK.
The first test was, ‘would it run on Server 2016’, it detected the OS as Windows 10 (unsurprisingly), and installed fine;
Microsoft Edge on Remote Desktop Services
Well Citrix is really just Remote Desktop Services in a leather jacket, so the next test was,’ would it work in RDS?’ I span up an RDS farm on the bench, and was pleased to see I could select Microsoft Edge as a RemoteApp, (not that I needed to deploy it using RemoteApp, but it being detected was promising).
And in an RDS session it worked faultlessly.
Deploy Microsoft Edge on Citrix (Server 2016)
Here’s where we had a problem, it installed fine, but every time I went to open it, all I got was a ‘white screen’ for about 5 minutes, after this it burst into life, which I couldn’t really ask the client to put up with!
As this was happening when I launched the browser I ‘wrongly’ assumed it was a ‘first run‘ problem (for the uninitiated, previous Microsoft browsers got an annoying ‘how do you want to set the browser up’ routine, then finally dumped you on the MSN webpage, (does anyone actually use the MSN webpage?) While it didn’t cure my problem it’s worth mentioning how I stopped the first run dialog happening);
Controlling Microsoft Edge with Group Policies
If you are used to importing ADMX and ADML files then this will be a breeze to you. If you are really interested I cover the subject in great deal in the following post;
Computer configuration > Policies > Administrative Templates > Microsoft Edge
[/box]
Microsoft Edge: Stop Importing of Bookmarks/Favourites
Locate: ‘Automatically import another browser’s data and settings at first run‘ > Enable the policy, and select ‘Disable automatic import and the import section of the first run experience is skipped‘ > Apply > OK.
Microsoft Edge: First Run
This will disable the entire first run dialog;
Locate: ‘Hide the First-run experience and splash screen‘ > Enable the policy > Apply > OK.
As it was working in RDS and not working on Citrix, then the problem was probably Citrix*. Citrix is one of my weaker subjects, so credit for the actual fix should go to my colleague (Dan Brookes).
*After I had discounted existing group policies, and other installed applications.
Running Microsoft Edge while it was ‘hanging’ and looking at what was going on in ‘Process Monitor’ showed a lot of hook64.dll entries;
This pointed to the culprit, open the registry Editor (regedit) and navigate to;
[box]
HKEY_LOCAL_MACHINE > System > CurrentControlSet > Services > CtxUvi
[/box]
Locate the UviProcesExcludes REG_SZ value, edit it and add ‘msedge.exe;‘ to the end.
Theres probably one service you can restart, but I simply rebooted the server, (problem solved).
FSLogix and Microsoft Edge
If you are running FSLogix you should also add an ‘exclusion’ to the Redirections.xml file, (located in your \\{domain-name}\NETLOGON folder).
I deployed a Remote Desktop Services server today, and when I logged on with my test users I fired up Office, and got the welcome movie.
Thats going to annoy my client so I need to stop that happening. Yes I know its pretty straight forward but I’m not a 64 year old typist called Marjorie.
Solution
Note: This ia a ‘User’ Policy so you may need to enable ‘loopback processing’.
1. I’m going to use Group Policy to do this, Server does not come withe the Office 2013 administrative templates so you need to download them (links below.) Copy all the .admx files to %systemroot%PolicyDefinitions
2. Copy all the .adml files to %systemroot%PolicyDefinitionsen-US, (or your own locale folder if your not English).
Now you can create a new group policy, (or edit an existing one). [box]User Configuration > Policies > Administrative Templates > Policy definitions > Microsoft Office 2013 > First Run[/box] Locate and Enable the following two policies;
Disable First Run Movie
Disable Office First Run on application boot
Related Articles, References, Credits, or External Links
FEP is Microsoft’s offering for antivirus, try to think of it as the corporate version of Security Essentials. Just about everything on the net for managing it seems to be geared to managing it with SCCM. Which is fine if you have SCCM, but what if you don’t? Thankfully you can manage it with group policy, even if information on how to do it is rarer than hens teeth!
With a Microsoft CoreCAL you can use the FEP client, so if you already have CoreCALs, then it’s a solution that can save you some cash on your corporate AV strategy.
Solution
Installing Forefront Endpoint Protection
The client software is available in x64 and x86 bit flavours, it is installed from a single executable (FEPInstall.exe). There is no MSI installer (yeah thanks Microsoft!) So if you want to roll it out on mass, you need to either install it using a startup script, include the software in your ‘Master/Golden Image’ and re-image you machines, or tear your hair out trying to work out SCCM.
Managing Forefront Endpoint Protection with Group Policy
1. First you need to download the policy definitions, copy the FEP2010.admx file to %Systemroot%PolicyDefinitions.
2. Then copy the FEP2010.adml file to %Systemroot%PolicyDefinitionsEN-US
Creating a Group Policy Central Store
3. If you have all your ADMX policy definitions in a central location, all your clients can use them. The correct place for them is in the sysvol directory, in a folder called policies (this is where your clients read their group policies from). To create the directory issue the following command;
Here you will find the policy settings you require.
7. When you are controlling settings via GPO this is what you will see on the client machines.
Importing and Exporting Forefront Policy Settings
8. From the files you extracted earlier locate and run the FEP2010GPTool.exe. From here you can import and export all the policy settings from a particular group policy. Microsoft have published a set of policy settings which you can download for various server roles.
Note: By default each policy you import will merge with the existing settings in the GPO, unless you tick the “clear the existing Forefront Endpoint Protection settings before import” option.
Updates for Forefront Endpoint Protection
9. Windows uses it’s existing ‘Windows updates’ path for getting updates. If you have a WSUS server you will need to enable the updates in the ‘Products and Classifications’ section.
10. If you DONT have WSUS but you are behind a proxy, you can manage FEP proxy settings from the following policy.
Related Articles, References, Credits, or External Links
