Keep ADMX for Windows 10 or Windows 11 in the central store?

• Author
• Recent Posts

Wolfgang Sommergut

Wolfgang Sommergut has over 20 years of experience in IT journalism. He has also worked as a system administrator and as a tech consultant. Today he runs the German publication WindowsPro.de.

Latest posts by Wolfgang Sommergut (see all)

• New Group Policy settings in Windows 11 23H2 - Mon, Nov 20 2023
• Windows Server 2025 will support SMB over QUIC in all editions - Fri, Nov 17 2023
• Switch between Windows Terminal and the legacy console - Thu, Nov 16 2023

Windows 11 brought a whole new set of group policy settings that admins need to manage the new features of the OS.

Windows 10 21H2 also received some new options, some of which are not included in Windows 11's ADMX. If you administer Windows 10 PCs with Windows 11's ADMX, these settings will unfortunately be missing.

List of deviations

Microsoft has now published the settings that exist only for one of the two OS versions in a blog post. The overview is largely consistent with my comparison of the administrative templates, created using a PowerShell script.

The author of the blog post also assumes that the separate ADMX will remain in place until support for Windows 10 expires. Since many companies are gradually switching to Windows 11, they will have to deal with a mixed environment of both OS versions for a longer period of time. In this case, the question arises as to how to manage group policies.

Own admin workstation for ADMX

One option is to store the ADMX for the prevailing OS version in the central store and provide separate PCs for GPO management with the other templates. If, for example, you decide to use the ADMX from Windows 11 in the central store, then you will also have to set up an admin workstation with Windows 10 and add the following registry key there:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy]

"EnableLocalStoreOverride"=dword:00000001

This action causes the GPO editor to load the local templates.

Force loading of administrative templates from the local machine via an entry in the registry

Evaluate settings for Windows 10 21H2

An alternative would be to check the settings that exist only for Windows 10 and not for Windows 11. If you do not need them, then you can restrict yourself to the ADMX for Windows 11 in the entire environment. The following table contains the exclusive settings for Windows 10 21H2.

As you can quickly recognize, you can easily do without most of the settings. Many organizations no longer use Internet Explorer as their default browser, and other means can be used to prevent Flash from running.

The warning about the legacy Edge is of limited use in managed environments since users cannot usually update the browser themselves anyway.

The setting for delivery optimization allows the use of the BITS protocol and is unlikely to be important in practice. The extended data collection by Microsoft should not be urgent, either.

More important is the option to restrict Point and Print to administrators in order to secure the vulnerabilities in the print spooler ("PrintNightmare"). However, the corresponding setting can be obtained for Windows 11 via SecGuide.admx from the Security Baseline.

Group Policy to protect against the vulnerability in the print spooler

Finally, the settings for scanning zipped program files and RDS licensing remain. If you don't need them either, there's no reason to use a duplicate set of administrative templates.

Conclusion

Microsoft makes it unnecessarily difficult for admins due to the incompatible ADMX for Windows 10 and 11. There is no reason why the company could not consolidate all settings in the Windows 11 administrative templates and thus cover all older versions of the operating system.

A coexistence of the ADMX for Windows 10 and 11 cannot be avoided in mixed environments if one of the exclusive settings for Windows 10 is required. However, this should not be the case in most organizations so that you can limit yourself to the templates for Windows 11 there.