Understanding Administrative Templates

by Mitch Tulloch, author of Windows Server Hacks
03/01/2005

In a previous article of mine, I extolled AutoProf Policy Maker as a cool tool for extending the power of Group Policy. The tool lets you do many things that otherwise require a combination of Group Policy and custom scripts, and it also lets you deploy Registry changes to remote machines faster and more easily than by Microsoft's traditional approach of creating custom administrative templates. However, there are some situations where administrative templates are the best or most obvious approach, so let's dig into how they work and see what you can do with them. A quick side note before we get started, though: AutoProf has just changed its company name to DesktopStandard, and you can now find info about Policy Maker versions on the PolicyMaker Overview page.

Administrative templates are a key component of Group Policy on Windows 2000, Windows XP, and Windows Server 2003. These templates are Unicode-formatted text files with the extension .adm and are used to create the Administrative Templates portion of the user interface for the Group Policy Object Editor as shown in Figure 1.

Figure 1. The Administrative Templates portion of the Group Policy Object Editor interface is created by installed administrative template (.adm) files

Using the two Administrative Template sections of the Object Editor, you can deploy modifications to machine (HKLM) and user (HKCU) portions of the Registry of computers targeted by your Group Policy Object (GPO). All you need to do is link your GPO to the appropriate site, domain, or organizational unit (OU) and let Group Policy processing do its thing. Note that the administrative templates (.adm files) do not themselves modify the Registries of target computers--all they do is create the GUI elements in the Object Editor that let you configure Registry settings for computers targeted by your GPO.

The power of administrative templates becomes obvious in the fact that there are now more than 1,300 different Registry settings you can configure using them. These settings range from configuring network settings to locking down users' desktops to configuring how Group Policy itself works. To use an administrative template, you first have to install it using the Object Editor; there are several templates installed by default, as we'll see in a moment. You can also download additional templates for some Microsoft applications, and even create your own template from scratch if you need to.

Standard Templates

The standard administrative templates are found in the %windir%\inf folder on your machine, and the ones that are installed by default depend on the operating system version you are using. Table 1 gives a quick summary of the templates that are installed by default on different OS versions.

Template	OS versions	Description
Conf.adm	2000/XP/2003	Displays policy settings for configuring Microsoft NetMeeting
Inetres.adm	2000/XP/2003	Displays policy settings for configuring Microsoft Internet Explorer
System.adm	2000/XP/2003	Displays policy settings for configuring core OS GUI features
Wmplayer.adm	XP/2003	Displays policy settings for configuring Windows Media Player
Wuau.adm	2000SP3/XPSP1/2003	Displays policy settings for configuring automatic updates

Table 1. Default administrative templates

In addition to the above templates, which are installed by default on the platforms indicated, there are some other templates in %windir%\inf that are there for you to install if you need them. These are summarized in Table 2.

Template	Description
Common.adm	Displays policy settings that are in common with Windows 9x/NT (used with System Policy Editor poledit.exe)
Inetcorp.adm	Displays policy settings for configuring dial-up, language, and Internet Explorer temporary files
Inetset.adm	Displays additional policy settings for configuring Internet Explorer
Windows.adm	Displays policy settings specific to Windows 9x (used with System Policy Editor poledit.exe)

Table 2. Other standard administrative templates

More Templates

We'll see how to add and remove templates (and what this does in the Object Editor GUI) in the next article. But first, if you are a Microsoft shop, a whole bunch more templates are available to let you manage business productivity applications on your network using Group Policy. First, let's look at the templates available for Microsoft Office 2003 (see Table 3). These templates are available from the Office 2003 Resource Kit and give you a lot of control over Office applications deployed in a managed environment (that is, a Group Policy environment).

Template	Description
Aer_1033.adm	Displays policy settings for configuring Application Error Reporting
Access11.adm	Displays policy settings for configuring Microsoft Access 2003
Dw20.adm	This was an earlier template for configuring Application Error Reporting and has been replaced in Office 2003 by Aer_1033.adm
Excel11.adm	Displays policy settings for configuring Microsoft Excel 2003
Fp11.adm	Displays policy settings for configuring Microsoft FrontPage 2003
Gal11.adm	Displays policy settings for configuring Microsoft Clip Organizer
Inf11.adm	Displays policy settings for configuring Microsoft InfoPath 2003
Instlr11.adm	Displays policy settings for configuring Microsoft Windows Installer
Office11.adm	Displays policy settings common to all Office 2003 components
Onent11.adm	Displays policy settings for configuring Microsoft OneNote 2003
Outlk11.adm	Displays policy settings for configuring Microsoft Outlook 2003
Ppt11.adm	Displays policy settings for configuring Microsoft PowerPoint 2003
Pub11.adm	Displays policy settings for configuring Microsoft Publisher 2003
Word11.adm	Displays policy settings for configuring Microsoft Word 2003

Table 3. Office 2003 administrative templates

You'll also find updated templates for Office 2003 Service Pack 1 available here from the Microsoft Download Center. Earlier versions of Office also have their own set of templates you can use to configure them using Group Policy.

Still More Templates

There are still more templates available if you need them. For example, in the Windows Server 2003 Resource Kit Tools you'll find Inetesc.adm, which displays policy settings for the Microsoft Internet Explorer Enhanced Security Configuration in Windows Server 2003.

The Microsoft Download Center is also a great place to check if you need the latest templates to go with your particular platform-cum-Service Pack combination. You can get the latest download of Group Policy ADM files if you need it.

So now that you're almost swimming in a sea of administrative templates, what can you actually do with them? I'll talk about that in my next article.

Mitch Tulloch is the author of Windows 2000 Administration in a Nutshell, Windows Server 2003 in a Nutshell, and Windows Server Hacks.

Return to the Windows DevCenter.