Using Administrative Templates

Administrative templates are installed by default in Group Policies. They are changes to the Registry of Windows 2000 and XP machines. In the Registry, the changes are stored in the \HKEY_LOCAL_MACHINE (HKLM) hive for computer policies and HKEY_CURRENT_USER (HKCU) hive for user policies and then in the following hives under HKLM or HKCU:

 \SOFTWARE\POLICIES \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES 

By default, standard users do not have the rights to change Registry entries in these keys and change the Group Policy behavior because the keys are protected by ACLs.

You don't have to be limited by the default installed Administrative Templates. Microsoft provides additional templates to enhance the choices available for use with Group Policy, and custom Administration Templates can be written and imported to add custom keys and Group Policy options.

Understanding Polices Versus Preference

Both preferences and Policies are controlled through the Registry. Preferences are changes to the Registry that the user has control over and are not found in the Registry keys listed previously. These are options, such as wallpaper or screensavers. Policies are changes to the Registry in the keys listed previously which are protected by ACLs. Although Group Policy can overrule preferences, the basic user would normally have access to change the Registry settings through the operating system or an application. The Policy does not overwrite the preference keys, and if the policy is removed, the preferences will return. The preference settings remain in effect until they are removed or changed via the Registry.

It is a good idea to use policies rather than preferences when you want to control a certain aspect of an application or want something the user accesses to remain static. You can disable users from being able to change the appearance, configuration, or functionality of the item. For those items, using Administrative Templates is your best answer.

Using Microsoft Add-on GP Templates

Microsoft provides additional Administrative Templates for use with Microsoft Office ”usually as part of the Office Resource Kits. Installing these administrative templates provides you with many more Group Policy options for each Microsoft Office product.

Customizing Administrative Group Policy Templates

Beyond using the custom and default templates, it is possible for you to create your own customized Administrative template to enforce a Registry change. The changes appear in the Group Policy GUI format and can be configured through the GPMC or ADUC the way normal Group Policy would be configured. Customized templates can be very useful in a highly customized environment or one where the default choices are not sufficient.

To best determine how to write a custom template, you must first consider what you are trying to control or change. You must also discover whether the Registry change is in the User or Computer hive area and then also note the actual Registry path and Registry value. After you have determined these items, coding a new basic administrative template is not too complex.

Administrative templates vary from the very basic to the extremely complex (look at the common.adm that is installed with Windows 2003). However, they can be extremely useful tools with which to customize any environment using Group Policy. Read Microsoft's white paper entitled "Implementing Registry-Based Group Policy for Applications" for detailed instructions on how to build a custom Administrative Template.