Windows 10 or Windows 11 GPO ADMX - Which One To Use For Your Central Store?

quite bad if your company have W10 and 11 (e.g. due to transition phase)

Thanks for your article hewagen.

As a Senior IT expert helping customers with the transition, which includes maintaining their GPO my main questions / concerns are:

1. Why does Microsoft maintain two ADMX policy sets in the first place? The Windows 11 ADMX should contain all settings and should be highly compatible with Windows 10 21H2 or earlier supported versions. It baffles me to be honest.

2. Why is the Windows 10 21H2 kept being updated and the other Windows 11 21H2 ADMX not being updated for a long time now, and as such missing settings?
There is nothing worse than GPP or registry hacks imho if it is avoidable.

3. Microsoft should understand this approach is not feasible. Even more we now have no further SAC but GAC starting with 21H2, the efforts to combine the templates should be considered. The gap, as per example below, can only get worse. 

EXAMPLE:
hewagen your table is missing a difference in both settings, the setting is (still) missing in Windows 11 ADMX, due them being pretty much outdated compared to the Windows 10 21H2 ADMX. The release of Windows 11 ADMX missed this change by 2 days a week only , which now cause uneccessary confusion.

References:
KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates (microsoft.com)

KB5005652—Manage new Point and Print default driver installation behavior (CVE-2021-34481) (microsoft.com)

Set RestrictDriverInstallationToAdministrators using Group Policy

After installing updates released October 12, 2021 or later, you can also set RestrictDriverInstallationToAdministrators using a Group Policy, using the following instructions:

1. Open the group policy editor tool and go to Computer Configuration > Administrative Templates > Printers. 

2. Set the Limits print driver installation to Administrators setting to "Enabled". This will set the registry value of RestrictDriverInstallationToAdministrators to 1.

hewagen what's also missing in the Windows 11 ADMX is the OS filtering option.

It ends with Windows 10.

When you open the GPMC and edit a GPO or local GP Editor you can right click on ADMX templates (in central store or local) and use a very sufficient filter, which has been maintained for decades now.

Windows 11 is the exception. There's no new OS category for this OS.

Can you please ask the team why we cannot filter for Windows 11 anymore if the Windows 11 ADMX introduced OS build specific settings?

In practice the central store is used to manage Windows Server and Windows Client OS, no matter the version, starting with XP/2003 or Vista/2008.

This should not been changed. The workaround in the blog is not helpful for common management scenarios.

Generally admins should not use their own devices to execute management tasks but a seperate host and user dedicated to these elevated tasks.

What a mess. It's gonna be a pain to manage both worlds (Win10 & 11) in transition phase. 

Microsoft you can do better.

This is terrible.  Microsoft seems to lack any understanding or empathy for organisations trying to manage their products or they wouldn't introduce this mess. Do better Microsoft.

As time goes on and environments get more and more mixed, this will be insanely confusing and borderline untenable in large environments with many complex GPOs. We already have enough things to worry about between testing patches for Microsoft (see January updates), researching and mitigating a never-ending flood of vulnerabilities, etc.

What possible explanation could there be to not have one set of templates, and Win11-exclusive settings simply having a Requirement of "Windows 11". You know, exactly how Windows 10 was handled?  If there's conflicts, move older settings to a "Legacy Settings" subfolder, exactly like was done with Windows Updates' settings in recent ADMX templates.

This is a tone-deaf decision that I think Microsoft should reconsider.

Issues have been fixed now in the Win 11 v3 ADMX files, released on July 21, 2023. See the blue box in at the top of the blog for further details.

You can now use the new ADMX templates to maintain both, Win 10 and Win 11 clients in your environment.

I can't believe what I've just read...

This looks to me a further sign that Windows 11 is not a real candidate for serious Enterprise deployment yet.  Don't even get me started on the Teams shortcut debacle.

Please fix this, as in its current state it's basically broken.

What about those of us using AGPM for change control, history, auditing, and delegation?

I'd like to echo all of the feedback above. Our org will be Win10 and Win11 for quite some time (as older TPM PCs that can't in-place upgrade exit the environment as they age out (attrition.)) This will make supporting both much more difficult.

Is there a technical reason that Win10 and Win11 ADMX files can't be a single ADMX file like Microsoft has done for years with past OSs? Thanks