Default ADM's in GPO's

[mrslimey]

If i have say 30 GPO's and each GPO includes the default GPO's of:

conf.adm
intres.adm
wmplayer.adm
system.adm

Does this mean I am replicating 30 times the total size of all of these adm's which is about 3.5 MB to each site that I have replication set up on.

Does anyone have advice or fine tuning ADM's when it comes to replication. For instance if only one of these adm's is required in a single GPO it would be considered fine to remove the others.

Interested in anyone's view on this topic

 

[markdmac]

Congratulations mrslimey, you hit the nail right on the head. So few people realize what you have figured out!

With proper planning you can shrink your GPOs down to around 22kb.

I've written an FAQ on this subject that I think should be of interest to you. faq329-6116

I hope you find this post helpful.

Regards,

Mark

 

[PScottC]

I would suggest picking a "master" GPO editing workstation and keeping the latest and greates ADM files there. Use only that station for creation/editing of GPO's. When you are done with your edits, simply remove all the ADM's from the GPO and go. The client systems don't need the .adm files and won't download them from the server. As Mark suggested above, you should be able to get the policy down pretty small. I think that most of mine actually average between 200 and 400K, but that's still much better than 3.5 - 4.5MB.

Good Luck!

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[mrslimey]

Thanks for your feedback Mark and PSC. Interesting and mostly taken on board. I do have a question for you PSC. From what you have written am I correct in understanding that you can remove all adm's from a GPO once you have completed editing? Does the ADM not need to be wrapped up with the policy in order for the GPO to work?

Mr Slimey

 

[PScottC]

Nope. The GP editor takes the changes you make and writes them to the appropriate .pol file in the group policy folder on the server. The .pol files are downloaded and applied by the client systems, and the .adm files are ignored. They are uploaded to the server simply to ensure that administrators use the same .adm files whenever they have to edit the gpo. If you designate one machine from which you always edit gpos, then you don't have to worry about .adm consistency.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[markdmac]

You can safely remove all of them and there is no need to backup as they are only copies of the originals which are stored in Windows\Inf.

When a new policy is creted the base MS ADM files you note above are copied to the new policy. Removing them from the GPO does not delete the original template, only removes them from the policy.

You can view how they are "wrapped up" as you put it by looking in the Windows\Sysvol\Sysvol\Policies folder.

I hope you find this post helpful.

Regards,

Mark