Final Thoughts

It's easy to use Microsoft and third-party, vendor-supplied ADM templates to control your applications or to make your own ADM modifications. But rememberonly applications coded to read Registry settings from the Policy keys will be true Policies. They will be applied and removed when different users log on or off. They will not tattoo. They will appear with a blue dot in the Group Policy Object Editor.

Most applications are not yet Policy key-aware, which means if you want to create your own modifications, you'll likely need to make them preferences. Preferences do not modify the Policy keys. They tattoo the Registry. They will appear with a red dot in the Group Policy Object Editor.

Be wary of download ADM templates you find online. They'll usually work as advertised, but the problem, again, is that they're likely chock full of irritating tattooing preferences, not lovely non-tattooing policies. One site that's full of such ADM templates is http://worldofasp.com/ts/download.cfm . Of course, I have some free ADM templates to download at www.GPanswers.com .

Creating an ADM template can sometimes be difficult. The hardest part can be figuring out which Registry setting you need to modify on the client system. You can use several tools to help you. One such tool is called Regmon from Sysinternals, at www.sysinternals.com/ntw2k/source/regmon.shtml . Regmon can help point out what's changing on the client. Then, armed with that information, you can triumphantly create your own custom ADM template and try it.

You can find the syntax you use to create your own custom ADM templates in "ADM Template Syntax" on this book's website.

Tip 

You'll find a good article to supplement your reading on creating a management workstation in the Microsoft Knowledge Base: see "Administering Windows Server-Based Computers Using Windows XP Professional-Based Clients" (304718).