ADM fully managed or not

[Pete-L]

I've created an ADM to remove the Domain option (Thanks
Martin) and disable the 'logon using dial-up'.

It works fine, but when I view it in GPO Editor it is
classed as a policy setting that can't be fully managed
(so although the template is visible the settings are not)

What's the difference between one that can be fully
managed and one that can't (apart from the fact that it's
classed as not fully manageable) is it in the coding
or... ?

TIA

Pete.

[Oli Restorick [MVP]]

Hi there

A fully-managed Group Policy setting is one that will undo itself when it
falls out of scope (by the GPO being deleted or no longer applying to the
user or computer object). Other policies are said to "tattoo" themselves.

There are two classes of Group Policy settings -- those, such as the
Internet Explorer policies, that use a client-side extension, and
tradtitional policies which are registry-based.

For example, take the setting in Microsoft Office that allows user templates
path to be set. The ADM files that shipped with older versions of Office
modified the file locations directly in the registry, overwriting the
defaults. The application was set only to read the location from that
particular registry value.

Newer applications and Windows itself will look to the
HKEY_CURRENT_USER\Software\Policies registry key to see if a policy has been
set. If so, they use the setting from there. Otherwise, they will use
their normal registry setting. That way, when a policy is removed, the
application will revert to its original setting.

With the case of the ADM file you've written, the "application" doesn't
understand the concept of policies and so you've had to modify the registry
values directly.

I'd be very interested to see the ADM file you've written. It sounds like
it could be useful for me, too.

Hope this helps

Oli

"Pete-L" <anonymous@discussions.microsoft.com> wrote in message
news:1b27401c44fab$d15d6fa0$a501280a@phx.gbl...

> I've created an ADM to remove the Domain option (Thanks
> Martin) and disable the 'logon using dial-up'.
>
> It works fine, but when I view it in GPO Editor it is
> classed as a policy setting that can't be fully managed
> (so although the template is visible the settings are not)
>
> What's the difference between one that can be fully
> managed and one that can't (apart from the fact that it's
> classed as not fully manageable) is it in the coding
> or... ?
>
> TIA
>
> Pete.

[Pete-L]

Oli

Thanks for the response. A copy of the adm is below,
forgive the differences in construction between the two
options (yes/no, list) but this is experimental to get
used to creating adm files.

--- cut ---
CLASS MACHINE
CATEGORY !!Customised
CATEGORY !!Logon
KEYNAME !!winlogon
POLICY !!ReDomain
Explain !!RemOption_Help
VALUENAME NoDomainUI
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY ;ReDomain

POLICY !!Dial-Up
EXPLAIN !!Dial-Up_Help
PART "LogonDial-Up" DROPDOWNLIST
VALUENAME "Dial-Up "
ITEMLIST
NAME !!DialUp0 VALUE "0"
NAME !!DialUp2 VALUE "1"
DEFAULT
END ITEMLIST
END PART
END POLICY ;Dial-Up
END CATEGORY ;Logon
END CATEGORY ;Customised

[STRINGS]
Dial-Up="Disable log on using Dial-Up"
DialUp0="Enable log on using Dial-Up"
DialUp2="Disable log on using Dial-Up"
Customised="Company Customised"
Logon="Logon Screen Options"
winlogon="SOFTWARE\microsoft\windows
nt\currentversion\winlogon"
ReDomain="Remove DOMAIN from log on options"
RemOption_Help="Remove DOMAIN option from logon screen
\n\nPrevent users from selecting domain or local machine
as a logon option \n\nusers must enter name@domain
Dial-Up_Help="Disable connect using Dial-In"

---cut---

RemOption_Help has wrapped quite a bit!

HTH

Pete.

>-----Original Message-----
>Hi there
>
>A fully-managed Group Policy setting is one that will

undo itself when it

>falls out of scope (by the GPO being deleted or no longer

applying to the

>user or computer object). Other policies are said

to "tattoo" themselves.

>
>There are two classes of Group Policy settings -- those,

such as the

>Internet Explorer policies, that use a client-side

extension, and

>tradtitional policies which are registry-based.
>
>For example, take the setting in Microsoft Office that

allows user templates

>path to be set. The ADM files that shipped with older

versions of Office

>modified the file locations directly in the registry,

overwriting the

>defaults. The application was set only to read the

location from that

>particular registry value.
>
>Newer applications and Windows itself will look to the
>HKEY_CURRENT_USER\Software\Policies registry key to see

if a policy has been

>set. If so, they use the setting from there. Otherwise,

they will use

>their normal registry setting. That way, when a policy

is removed, the

>application will revert to its original setting.
>
>With the case of the ADM file you've written,

the "application" doesn't

>understand the concept of policies and so you've had to

modify the registry

>values directly.
>
>I'd be very interested to see the ADM file you've

written. It sounds like

>it could be useful for me, too.
>
>Hope this helps
>
>Oli
>
>"Pete-L" <anonymous@discussions.microsoft.com> wrote in

message

>news:1b27401c44fab$d15d6fa0$a501280a@phx.gbl...

>> I've created an ADM to remove the Domain option (Thanks
>> Martin) and disable the 'logon using dial-up'.
>>
>> It works fine, but when I view it in GPO Editor it is
>> classed as a policy setting that can't be fully managed
>> (so although the template is visible the settings are

not)

>>
>> What's the difference between one that can be fully
>> managed and one that can't (apart from the fact that

it's

>> classed as not fully manageable) is it in the coding
>> or... ?
>>
>> TIA
>>
>> Pete.

>
>
>.
>