Article ID: 323639
Article Last Modified on 3/27/2007
APPLIES TO
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional Edition
- Microsoft Windows 2000 Server
This article was previously published under Q323639
IN THIS TASK
SUMMARY
This step-by-step article describes how to create custom Administrative Templates to use with Group Policy settings in a Windows 2000-based domain.
Group Policy templates provide an interface that you can use to apply registry changes to the target computer. Unlike policy settings that you create in Microsoft Windows NT 4.0, if you use Group Policy to apply registry changes, you can make these registry changes non-persistent. This means that when you log off the computer or when you shut down the computer, the policy settings are removed. To create non-persistent policy settings, you must create the registry changes on the target computer in one of the following registry locations:
- For computer policy settings:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies-or-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies - For user policy settings:
HKEY_CURRENT_USER\SOFTWARE\Policies-or-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
Microsoft recommends that you copy the registry structure of the existing component when you create the Administrative Template. For example, you may want to modify a component in the following registry location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\<componentname>
In this situation, create an Administrative Template that references the following registry location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\<componentname>
NOTE: If Group Policy changes the target computer's registry in a location other than one of these locations, these changes are persistent. These changes are not removed when you log off the computer or when you shut down the computer. This behavior is also known as "tattooing" the registry.
Although you can edit the Administrative Templates that are included with Windows 2000, Microsoft recommends that you either create a new template or edit a copy of an existing Administrative Template. You must do so because the existing templates may have been updated or changed if you installed service packs or other updates to Windows.
back to the top
How to Create a Group Policy Object
To create a Group Policy object (GPO) in which to import a custom Administrative Template:
- Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
- In the console tree, right-click the domain or the organizational unit in which you want to create the Group Policy setting, and then click Properties.
- Click the Group Policy tab, and then click New.
- Type a name for this Group Policy setting (for example, custom registry policy), and then press ENTER.
- Click Close.
How to Create an Administrative Template
- Start Notepad or another text editor, and then type the Administrative Template information.
- Save the file in the
Windows_folder\Inf folder, and then give it an .adm file name extension. - Quit the text editor program.
How to Load the Administrative Template
- Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
- Right-click the domain or the organizational unit that you want to configure, and then click Properties.
- Click the Group Policy tab, click the Group Policy setting that you want to edit, and then click Edit.
- Under either Computer Configuration or User Configuration, right-click Administrative Templates, and then click Add/Remove Templates.
- Click Add, click the template that you want to add, and then click Open.
- Click Close.
Example
The following example describes how to create a custom Administrative Template:
- Start Notepad.
Type the following code:
CLASS USER ;This modifies the HKEY_CURRENT_USER portion of the registry ; the following command creates a node called Desktop Settings ; under User Configuration. CATEGORY !!categoryname ; the following command specifies the registry key to modify KEYNAME "SOFTWARE\Policies\System" ; the following command specifies the name of the policy ; by using the variable "policyname" POLICY !!policyname ; the following command specifies text on the Explain tab EXPLAIN !!explaintext ; the following command creates a PART that contains a list box PART !!labeltext DROPDOWNLIST REQUIRED ; the following statement specifies the registry value to modify VALUENAME "NoDriveTypeAutoRun" ; the following statement populates the drop down list ITEMLIST NAME !!no_cd VALUE NUMERIC 181 DEFAULT NAME !!no_drives VALUE NUMERIC 255 END ITEMLIST END PART END POLICY END CATEGORY ; the following strings section assigns character strings ; to the variable names specified in the previous section [strings] categoryname="Desktop Settings" policyname="Disable the autoplay feature" explaintext="This policy disables the autoplay feature on the selected drive(s)" labeltext="Disable autoplay on" no_cd="CD-ROM drives" no_drives="All drives"- On the File menu, click Save As.
- In the Save as type box, click All Files.
- Type windows_folder\inf\example.adm in the File name box, and then click Save.
- Quit Notepad.
- Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
- Right-click the domain, and then click Properties.
- Click the Group Policy tab, click New, type test policy in the New Group Policy Object box, and then press ENTER.
- Click Edit, right-click Administrative Templates under User Configuration, and then click Add/Remove Templates.
- Click Add, click Example.adm, and then click Open.
- After "Example" appears in the Current Policy Templates list, click Close.
- Under User Configuration, expand Administrative Templates, and then click the new Desktop Settings node.
- In the right pane, double-click the Disable the autoplay feature policy.
Note: If your new policy setting does not appear in the right pane as you expect, right-click the new Desktop Settings node, point to View, and then click to clear the check mark that is beside the Show Policies Only menu item. - Click Enabled, and then make sure that the policy setting contains the features that you specified in the sample code.
Troubleshooting
In some cases, you may not be able to determine the registry path to use to create an Administrative Template. You can use registry monitoring utilities for this purpose. For additional information about the Regmon tool, visit the following Sysinternals Web site:
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
back to the top
REFERENCES
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
259576 Group policy application rules for domain controllers
For more information about policy settings and templates, click the following article numbers to view the articles in the Microsoft Knowledge Base:
216661 How to implement a policy to set the date format
294832 How to disable Windows 2000 dynamic domain name system registrations with group policy
313924 How to make the shutdown button unavailable in the logon dialog box in Windows 2000
307882 How to use the group policy editor to manage local computer policy in Windows XP
For more information about Group Policy, see the "Introduction to Windows 2000 Group Policy" white paper at the following Microsoft Web site:
Additional query words: adm
Keywords: kbhowtomaster KB323639
