One of the questions that came up at last night’s TechNet session was .ADM template files and where to get them. JohnM from EDS pointed me to the download page for current ADM templates. Thanks for making my job easier John!

Here’s the link
http://www.microsoft.com/downloads/details.aspx?FamilyId=92759D4B-7112-4B6C-AD4A-BBF3802A5C9B&displaylang=en#filelist

Some related information about ADM templates for managing group policy also turned up in my research. Before you download these files and start using them, you should be aware of the impact they might have in your environment first. 

Hun? Impact? They’re just files, what impact can they have? Replication my friend is blowing in the wind. The .adm files are 3.17 megs in size. Updated files =  replication using FRS to all your DCs = WAN traffic.

Check out this KB article 816662 (http://support.microsoft.com/default.aspx?scid=kb;en-us;816662) To summarize the major points:

  • The default behaviour for .adm templates and GPEDIT.MSC (group policy MMC)  is to use the local admin workstation copy from %windir%\inf.
  • If the local copy is newer then the copy on the SYSVOL GPT (GroupPolicyTemplate) then it is copied up to the GPT folder on the server.
  • It uses the Date and Timestamp of the adm file to determine which one is newer. Because of this, if you want to modify the ADM template, it is recommended that you create your own NEW one for your specific settings – leave the system ones alone.
  • Entries are Cumulative. If you have W2K SP4 and bring in Win XP-SP2, a bunch of .adm files will be updated. This will NOT mess up your W2K SP4 settings.
  • You can turn off the auto-upload process if you want to manage your own version of files on local admin workstations.

That last statement is powerful. Why would you want to do that? Have you thought about language? If your co-worker works with a French admin workstation (which is quite possible in our bilingual culture here in Canada), his/her adm templates will upload overtop of the server based ones if they have a newer date and time stamp. You can prevent this from happening if you establish a policy (human policy, not Group Policy <g>) that states all ADM templates are stored in a central location and should be copied down to the local admin workstation (or server) where GPEdit is launched.  That way you can control which templates are used and what versions / language you want to work in.

Have a good read of that KB816662… It’s worth the time to investigate your options and establish a proper .adm template process.  This is something that you might have overlooked in your planning exercise for managing AD.

Lastly, here is a link to the Windows 2003 Online technical reference that deals with Administrative Template Extension Technical Reference. It has links to three areas of information on ADM template and how they work in the GPO process. It also has some additional planning excel spreadsheets for GPO settings.  It's a good read.
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techref/en-us/Default.asp?url=/resources/documentation/windowsServ/2003/all/techref/en-us/W2K3TR_gpadm_intro.asp