Windows 10 21H1: Ten new GPO settings, ADMX download ...

06, while in the newer edition “Administrative Templates (.admx) for Windows Server 2022 August 2021 Update” the same file is modified 2021.05. TogglenavigationPostsBlogWikiPowerShellWikiNewsForumsITAdministrationForumPowerShellForumCommunityForumCommunityRegisterSite-WideActivityPowerShellGroupPowerShellWikiMembersContributetothe4sysopscommunityMemberpointsystemandprizeMemberRanksMemberLeaderboard–ThisMonthMemberLeaderboard–ThisYearMemberLeaderboard–All-timeAuthorLeaderboard–Last30DaysAuthorLeaderboard–ThisYearSitemapCloudComputingDeploymentSecurityMonitoringNetworkingPowerShellSitemapAboutAboutAuthorsWritefor4sysopsSponsorsContactLoginWindows1021H1:TennewGPOsettings,ADMXdownloadandsecuritybaselineavailable,noADKorRSATHomeBlogWindows1021H1:TennewGPOsettings,ADMXdownloadandsecuritybaselineavailable,noADKorRSAT4sysops-TheonlinecommunityforSysAdminsandDevOpsWolfgangSommergut&nbsp Thu,May272021Thu,May272021&nbsp activedirectory,grouppolicy,windows10&nbsp 4Microsofthasreleasedversion21H1ofWindows10.Thisisasmallupdatethatisactivatedviaanenablementpackage.Atthesametime,theADMXtemplatesforthegrouppolicies,whichcontaintennewsettings,areavailable.TherearenonotablechangeswiththeSecurityBaseline,theADK,ortheRSAT.AuthorRecentPostsWolfgangSommergutWolfgangSommerguthasover20yearsofexperienceinITjournalism.Hehasalsoworkedasasystemadministratorandasatechconsultant.TodayherunstheGermanpublicationWindowsPro.de.LatestpostsbyWolfgangSommergut(seeall)CreateaWinPEbootablediskwithWindows11-Tue,May242022DisableWindows11widgetsusingGroupPolicy-Fri,May62022AddalanguagepackinWindows11-Tue,May32022ContentsNewGPOsettingsADMXdownloadSecurityBaseline,ADK,andRSATConclusionAswithversion20H2lastfall,Microsoftisdeliveringthefewnewfeaturesof21H1(seeanoverviewhere)inadvanceviaacumulativeupdate.ThistimetheywereincludedintheMayupdateforversions2004or20H2.However,thenewfeaturesremaininactiveuntiltheenablementpackageunlocksthem.ThisisdeliveredviaWSUSandWindowsUpdateforBusinessasKB5000736,andisalsoavailableintheDownloadandVolumeLicensingCenter.Theofficialreleasealsomarksthestartofthesupportperiodof18months,whichMicrosoftgenerallygrantsforalleditionsofthespringupdate.ThenewfeaturesdeliveredintheMayupdatearereleasedasKB5000736Userswhoarestillrunningaversionolderthan2004willneedaconventionalupgrade,whichrequiresseveralreboots.NewGPOsettings^Windows1021H1doesn'tincludeanynewfeaturesthatwouldrequireadditionalgrouppoliciesfortheirconfiguration.Nevertheless,theupdatebringstennewsettingsforcomponentsthathavebeeninplaceforawhile.MostofthemservetodrivethetransitionfromlegacywebbrowserstoEdgeChromium.InternetExplorercannowbedeactivatedasastandalonebrowser.IEthenonlyservesasarenderingengineforEdgeinInternetExplorerMode.IfausertriestostartIE,thisgrouppolicyautomaticallyredirectsthepagetoloadinEdge.TheGroupPolicysettingsintroducedwithWindows1021H1TwoothersettingscontrolthebehaviorofIEwhenitisrunasacomponentofEdge.YoucannowshowtheSavetargetasentryinthecontextmenuofalink.Theotheroptionallowsyoutoactivatehotkeys,suchasCTRL+S.ThelegacybrowsersalsoincludethefirstgenerationofEdge,whichMicrosoftisnowreplacingwiththeChromiumversionduringWindows10featureupgrades.Untilthischangehastakenplace,adialogwarnstheuserthatthecurrentbrowserisoutdated.Thismessagecanbesuppressedviaanothersetting.Inaddition,thereisanoptionforWindowsUpdate.Itisusedtodeactivatetheso-calledsafeguards.Thesepreventtheinstallationoffeatureupgradesoncomputersthatcontaincomponentsknowntocauseproblemswithaparticularversionoftheoperatingsystem.Anothersettingallowsyoutoswitchoffthenewsfeedinthetaskbar.ThenextoneremovestheiconforMeetNow,whichisafeatureforvideoconferencingonSkype.TheremainingsettingscontroltextrecognitionforTIFFfiles,whichisafeatureofWindowsSearch.Theyallow,forexample,theselectionofthelanguagebasedonthecodepageorcausetheOCRfunctiontoalwayscaptureallpagesofaTIFF.Inthepast,searchOCR.admx,whichcontainsthesesettings,wasaconstantsourceoferrormessages;whilethelanguagefileswereavailable,theactualtemplateforthemwasmissing.DetailedinformationaboutallsettingscanbefoundintheGroupPolicySettingsReferenceSpreadsheet.Italsoexplicitlymarksnewoptions.ADMXdownload^Thetemplateswithallcurrentsettingsforthegrouppoliciesare,asusual,partoftheoperatingsystemandcanbefoundunder%SystemRoot%\PolicyDefinitions.Inaddition,thecompletetemplatescannowbedownloadedfromMicrosoft'sDownloadCenter.Asusual,thispackagecomeswith22languagefiles,whereasonaworkstation,onlyen-USorthelanguageofthelocalizedWindowsisavailable.TheADMXdownloadprimarilybenefitsuserswhouseWindows10inmultiplelanguageversions.TheadministrativetemplatesmustbeunpackedwithelevatedrightsInaddition,thereareADMXsthatarenotrelevanttolocalgrouppoliciesandarethereforenotpartoftheoperatingsystem.ThisincludesGroupPolicyPreferences.admxfortheconfigurationofGroupPolicyPreferences,whichareavailableonlyindomains.Overall,thedownloadisparticularlyrecommendedifyouwanttokeepthetemplatesinacentralstore.SecurityBaseline,ADK,andRSAT^TheSecurityBaselineisanothertoolthatMicrosoftprovideswiththereleaseofWindows1021H1.Itcontainsthemanufacturer'srecommendedsettingstohardenthesystem.Theupdatedoesnotaddanynewsettingsorremoveexistingones.ThebaselinewasrefreshedprimarilytobringthedocumentationuptodatewiththenewGPOsettings.ItcanbedownloadedaspartoftheMicrosoftSecurityComplianceToolkit.ThisalsoincludesthebaselinesforEdgeandtheMicrosoft365applications.TheSecurityComplianceToolkitcontainsthebaselinesforWindows1021H1EdgeundMicrosoft365ThesameappliestotheAssessmentandDeploymentKit(ADK).Since21H1sharesthekernelandsystemfileswiththepredecessors,thereisnoneedforanupdatehere.ThisisalsotrueforWinPE,whichhasbeenaseparatedownloadsinceWindows101809.Thus,youcancontinuetousetheexistingdeploymenttools.21H1doesnotbringanychangestotheRemoteServerAdministrationTools(RSAT).Sinceversion1809,ithasnotbeennecessarytodownloadthesetoolsseparately,buttheRSATareinstalledasanoptionalfeature.Subscribeto4sysopsnewsletter!Conclusion^ThesmallnumberofinnovationsinWindows1021H1isreflectedinthetoolsfortheadministrationanddeploymentofthesystem.Onlythegrouppoliciesbringsomeadditionalsettings;otherwise,thetoolboxremainslargelyunchanged.Wanttowritefor4sysops?Wearelookingfornewauthors.Read4sysopswithoutadsandforfreebybecomingamember!RelatedArticles+CreateActiveDirectoryuserswithPowerAutomateforDesktopBrandonLee&nbsp Mon,May232022Mon,May232022&nbsp activedirectory&nbsp 1Traditionally,ITmaydelegatepermissionsinActiveDirectoryUsersandComputers(ADUC)tomanagersorotheruserswhoneed...+WhenthetrustrelationshipbetweenaworkstationandtheprimaryADdomainfailsWelfAlberts&nbsp Wed,May182022Sat,May212022&nbsp activedirectory,security&nbsp 5If,atlogon,youreceiveanerrormessagethatthetrustrelationshipbetweenaworkstationandtheprimarydomain...+DisableWindows11widgetsusingGroupPolicyWolfgangSommergut&nbsp Fri,May62022Fri,May62022&nbsp deployment,grouppolicy&nbsp 0ThewidgetsinWindows11areessentiallythesuccessorsofNewsandinterests,knownfromWindows10.Likethese,...+ConfiguringSSObetweenActiveDirectoryandAzureusingpass-throughauthenticationMarcelKüppers&nbsp Mon,May22022Mon,May22022&nbsp activedirectory,azure,cloudcomputing&nbsp 1Pass-throughauthenticationisanalternativetoADFSandpasswordhashsynchronizationinAzureAD.Thistechnologyallowsusers...+CreateandmanagecustomADattributeswithPowerShellSurenderKumar&nbsp Fri,Mar42022Mon,Apr252022&nbsp activedirectory,powershell&nbsp 6Inthisarticle,IwillshowyouhowyoucanextendtheADschema,createcustomattributes,andmanage...+ConfigureprotectionagainstpotentiallyunwantedappsusingPowerShellorGroupPolicyBrandonLee&nbsp Tue,Feb152022Tue,Feb152022&nbsp grouppolicy,security&nbsp 0Potentiallyunwantedapplications(PUAs)aresoftwareappsthatdothingsthatborderonmaliciousactivity.Thesecanincludedisplaying...+ExploitingtheCVE-2021-42278(sAMAccountNamespoofing)andCVE-2021-42287(deceivingtheKDC)ActiveDirectoryvulnerabilitiesKrishnamoorthiGopal&nbsp Thu,Feb102022Thu,Feb102022&nbsp activedirectory,security&nbsp 2AfterMicrosoftreleasedsecuritypatchesfortwoActiveDirectoryvulnerabilitieswiththeTuesday,November9,2021patch,Microsofturged...+JoiningAzureADfails—Can’tconnecttoURLforyourorganization’sMDMtermsRobertPearman&nbsp Wed,Feb92022Thu,Feb102022&nbsp activedirectory,azure,cloudcomputing&nbsp 0WhenjoiningadevicetoAzureAD,youmayreceivethefollowingerrormessage:Somethingwentwrong.Itlookslike...+Microsoftretires25grouppoliciesforWindowsUpdateWolfgangSommergut&nbsp Mon,Jan312022Mon,Jan312022&nbsp activedirectory,grouppolicy,patchmanagement&nbsp 0Overtheyears,dozensofgrouppoliciesforWindowsUpdatehaveaccumulated,manyofwhichnolongerworkor...+KeepADMXforWindows10orWindows11inthecentralstore?WolfgangSommergut&nbsp Wed,Jan262022Wed,Jan262022&nbsp grouppolicy,windows,windows10,windows11&nbsp 0TheadministrativetemplatesforWindows11arenotbackwardcompatible;hence,Windows10cannotbefullymanagedwiththem....+Redirectuserprofilefolders(documents,pictures,etc.)toOneDriveforBusinessBrandonLee&nbsp Thu,Jan132022Thu,Jan132022&nbsp cloudcomputing,deployment,grouppolicy&nbsp 2Foralongtime,roamingprofilesandfolderredirectionwerethestandardmeansunderWindowsformakinguserfiles...+ConfiguringDFSNamespacesforAmazonFSxforWindowsfileserversMohamedWali&nbsp Fri,Jan72022Fri,Jan72022&nbsp activedirectory,AWS,cloudcomputing,networking&nbsp 0Thisstep-by-stepguideexplainshowtoconfigureDFSNamespacesforAmazonFSxforWindowsfileservers.+PerformActiveDirectorysecurityassessmentusingPowerShellKrishnamoorthiGopal&nbsp Thu,Jan62022Thu,Jan62022&nbsp activedirectory,powershell,security&nbsp 33MyActiveDirectorysecurityassessmentscriptpullsimportantsecurityfactsfromActiveDirectoryandgeneratesnicelyviewablereportsin...+ProtectActiveDirectorywithMicrosoftDefenderforIdentityBrandonLee&nbsp Wed,Jan52022Wed,Jan52022&nbsp activedirectory,security&nbsp 0MicrosoftDefenderforIdentityisacloud-basedsecuritysolutionthatcanidentifyattacksignalsinActiveDirectory.Thesolution...+MicrosoftEdge:OpennewtabwithoutMSNnews,configurestartpageswithGPOWolfgangSommergut&nbsp Tue,Jan42022Tue,Jan42022&nbsp activedirectory,browser,grouppolicy&nbsp 1IfyouopenanewtabinMicrosoftEdge,itwillloadtheMicrosoftNewspagebydefault.This...+TurnoffwebsearchinWindows11usingGroupPolicyWolfgangSommergut&nbsp Tue,Dec282021Tue,Dec282021&nbsp activedirectory,browser,grouppolicy&nbsp 3MicrosoftaddsresultsfromthewebifyourunalocalsearchunderWindows11.TheseoriginatefromBing...+In-placeupgradefromWindows10toWindows11usingMECMAlexanderPazik&nbsp Tue,Dec72021Tue,Dec72021&nbsp deployment,systemcenter,windows,windows10,windows11&nbsp 0WiththereleaseofWindows11,Microsofthasmadeiteasierthanevertoperformanin-placeupgradefrom...+BlocktheinstallationofUSBdevicesonWindowsPCsusingIntuneBrandonLee&nbsp Tue,Nov232021Tue,Nov232021&nbsp grouppolicy,intune,security&nbsp 0Managingenduserdevicesecuritysettingsisanintegralpartofanorganization'soverallcybersecurity.Microsoft365Intuneprovides...+ADMXtemplatesforOffice2021:compatiblewith2016GPOsand10newsettingsWolfgangSommergut&nbsp Mon,Nov152021Mon,Nov152021&nbsp activedirectory,grouppolicy&nbsp 0WiththereleaseofOffice2021,MicrosoftupdatedtheadministrativetemplatesforGPOs.However,thenewreleasedoesnot...+GroupPolicyinWindows11:Newsettingsfordevicemanagement,DoH,updates,andPrintNightmareWolfgangSommergut&nbsp Wed,Oct272021Wed,Jan192022&nbsp activedirectory,grouppolicy,windows,windows11&nbsp 0SincethepreviousreleasesofWindows10includedonlyafewnewGPOsettings,Microsofthasdecidedtointroduce...HowtosetoutofofficemessagesinMicrosoftTeamsMicrosoftUniversalPrint:Architecture,advantages,disadvantages,andlicensing4CommentsBruce2monthsagoHelloWolfgang–HaveyouexperiencedaproblemwithWindowsUpdateandOffice365Update?Ihave.neitherwillupdateautomatically.(IamanMSCE+I/MVP)soIhavedonealltheusual.EvenusingthelatestADMX.msiformyversion21H2andOS19044.1620,noautoupdateisworking.SoREGEDITandgpedit.msc.IdiscoveredthatthereisNOPoliciesfolderandsearchingforallfeaturesinbothComputerandUserConfigurationresultsinnohitsfor“office”or“update”.Office365Helppop-upwasofnouse.After29backandforth,thetechniciangaveup.Yourthoughtsifany?Dankeschoen!ReplyMajkel2monthsagoLet’stakeasample“Passport.admx”file.Inthepackage“AdministrativeTemplates(.admx)forWindows10November2021Update”themodificationdateis2021.10.06,whileintheneweredition“AdministrativeTemplates(.admx)forWindowsServer2022August2021Update”thesamefileismodified2021.05.08.Whydoesthenewersetcontainanolderfile?Iwouldliketoaddthatthefilesdifferinsizeand,afteranalyzingthecontents,theyhavedifferentparameters.ReplyBruce2monthsagoNowTHISONEIcananswer.ServerisadedicatedOSandwhilesimilartoPCbased,itisnotidentical.Hencethedifferentversionsofanyupdates.IunderstoodthisbackinWINServer2003andnothinghaschanged.DONOTDOWNLOAD/INSTALLServerversionsonahomePC.WIN8/10shouldpreventthisautomatically–butnotalways.ReplyMajkel2monthsagoBruce.ThereisnodistinctionbetweenthePCandServerversionsforthefilesIamtalkingabout.ADMXfilescontainpoliciesforbothworkstationsandserverstations.ReplyLeaveareplyClickheretocancelthereplyYouremailaddresswillnotbepublished.Requiredfieldsaremarked*CommentName*Email*WebsiteNotifymeoffollowupcommentsviae-mail.Youcanalsosubscribewithoutcommenting.ΔSubscribetonewsletterFollow4sysops©4sysops2006-2022CONTACTUSPleaseaskITadministrationquestionsintheforums.Anyothermessagesarewelcome.SendSendingLoginwithyourcredentialsor    CreateanaccountSigninRemembermeLostyourpassword?Forgotyourdetails?ResetPasswordIremembermydetailsCreateAccountRegister