Windows 10 or Windows 11 GPO ADMX - Which One To Use For Your Central Store?

[hewagen]

Hi community,

My name is Helmut Wagensonner. I’m a Customer Engineer at Microsoft and this blog should help you to understand, which Administrative Templates (admx) to choose for your Windows 11 / Windows 10 mixed environment.

NOTE: The content of this article is only useful if you use ADMX file versions released before 21/07/23.

All the issues between the different ADMX versions mentioned in this blog have been fixed as of 21/07/23. You can now use the new Windows 11 ADMX files (download from Microsoft Download Center) to maintain Windows 11 and Windows 10 clients.

Also note that DataCollection.ADMX is a special case. See here ADMX DataCollection Policy CSP, here Changes to Windows diagnostic data collection and the blue box below for further information.

NOTE: The telemetry settings (DataCollection.admx) have been changed and renamed in Windows 11. Following table shows the Win10 settings and their corresponding Win11 terms.

Windows 10 ADMX - Allow Telemetry	Windows 11 ADMX - Allow Diagnostic Data
0-Security	Diagnostic Data Off
1-Required	Send required Diagnostic Data
2-Enhanced	[not present]
3-Optional	Send Optional Diagnostic Data

Clients, which are configured to "2-Enhanced" using the Windows 10 settings, will automatically drop back to "Send required Diagnostic Data" in Windows 11.

First of all let me say that both versions of the ADMX templates mentioned below, can be used with Windows 10 as well as with Windows 11. They are indentical except very few settings. This article is only about how to configure a setting, which is missing in one of the templates. Once configured your GPOs will work on both operating systems.

As long as we support Windows 10 it could occur that new Windows 10 features are not reflected in Windows 11 ADMX files and vice versa. The table at the end of this article shows differences between the Win10 and Win11 templates (as of Dec 16, 2021).

So what to do if you have a mixed environment of both client operating systems? Well, fact is that you can only copy one set of ADMX files to your Active Directory’s Central Store. Depending on what your future plans are, you should decide which templates fit best. If you plan to stay on Windows 10 for a while, you should choose the Windows 10 ADMX files. If you’re ready to upgrade to Windows 11 and this will become your dominating OS version (or it already is), you should copy the Windows 11 ADMX files to your Central Store.

But can you configure new Windows 10 policies if your central store contains the Windows 11 ADMX files? Well, you can! You just need to do this from a separate client. The steps below explain the approach.

• Install a client with Windows 10 21H2 (important!) operating system and join it to your domain.
• Log on with an user with administrative rights.
• Right-click on your start menu and choose “Apps and Features”
  
• Choose “Optional Features”
  
• Choose “Add a Feature”
  
• Search for “RSAT: Group Policy Management Tools” and click the “Install” button.
  
• After successful installation you will find a “Group Policy Management” item in the “Windows Administrative Tools” folder in your start menu.
  
• Open your Registry Editor and add following registry value:
  Key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy
  Value: EnableLocalStoreOverride
  Type: REG_DWORD
  Data: 1
  
• Restart your computer and log on with a user account that has the right to edit domain Group Policy objects.
• Run the “Group Policy Management” from your start menu and open the desired GPO for edit. The Administrative Templates should now be taken from the client’s local store instead of the central store.
  

Following table illustrates differences between Windows 10 21H2 and Windows 11 21H2 ADMX files.

ADMX name	Scope	Setting	Available only in
AppPrivacy	Computer	Let Windows apps take screenshots of various windows or displays	Windows 11
AppPrivacy	Computer	Let Windows apps turn off the screenshot border	Windows 11
AppxPackageManager	Computer	Archive infrequently used apps	Windows 11
AppxPackageManager	Computer	Do not allow sideloaded apps to auto-update in the background	Windows 11
AppxPackageManager	Computer	Do not allow sideloaded apps to auto-update in the background on a metered network	Windows 11
CloudContent	Computer	Turn off cloud consumer account state content	Windows 11
CloudContent	User	Turn off Spotlight collection on Desktop	Windows 11
ControlPanelDisplay	Computer	Prevent lock screen background motion	Windows 11
DataCollection	Computer	Limit Diagnostic Log Collection	Windows 11
DataCollection	Computer	Limit Dump Collection	Windows 11
DeliveryOptimization	Computer	Discovery Mode: Local Discovery	Windows 11
DnsClient	Computer	Configure DNS over HTTPS (DoH) name resolution	Windows 11
EAIME	User	Configure Korean IME version	Windows 11
FileSys	Computer	Enable NTFS non-paged pool usage	Windows 11
FileSys	Computer	NTFS parallel flush threshold	Windows 11
FileSys	Computer	NTFS parallel flush worker threads	Windows 11
FileSys	Computer	Configure NTFS default tier	Windows 11
Globalization	Both	Restrict Language Pack and Language Feature Installation	Windows 11
InetRes	Both	Replace JScript by loading JScript9Legacy in place of JScript via MSHTML/WebOC.	Windows 11
Netlogon	Computer	Use lowercase DNS host names when registering domain controller SRV records	Windows 11
NewsAndInterests	Computer	Allow News and Interests	Windows 11
Sam	Computer	Configuration settings for the Security Account Manager	Windows 11
Sensors	Computer	Force instant Wake	Windows 11
Sensors	Computer	Force instant Lock	Windows 11
Sensors	Computer	Configure Lock Timeout	Windows 11
StartMenu	Both	Locked Start Layout: Re-Apply Layout at every logon	Windows 11
StartMenu	Both	Show or hide "Most used" list from Start menu	Windows 11
TaskBar	Computer	Configure the Chat icon on the taskbar	Windows 11
TenantRestrictions	Computer	Configure Cloud Policy Details	Windows 11
TerminalServer	Computer	Enable auto-subscription	Windows 11
TerminalServer	Computer	Do not allow location redirection	Windows 11
TerminalServer	Computer	Allow UI Automation redirection	Windows 11
WindowsDefender	Computer	Configure scheduled task times randomization window	Windows 11
WindowsDefender	Computer	Define the directory path to copy support log files	Windows 11
WindowsDefender	Computer	Configure IP Address Exclusions	Windows 11
WindowsDefender	Computer	Turn on script scanning	Windows 11
WindowsDefender	Computer	Allow Microsoft Defender Antivirus to update and communicate over a metered connection	Windows 11
WindowsDefender	Computer	Configure Network Protection to be allowed to be configured into block or audit mode on Windows Server	Windows 11
WindowsDefender	Computer	Control datagram processing for network protection	Windows 11
Sandbox	Computer	Allow vGPU sharing for Windows Sandbox	Windows 11
Sandbox	Computer	Allow networking in Windows Sandbox	Windows 11
Sandbox	Computer	Allow audio input in Windows Sandbox	Windows 11
Sandbox	Computer	Allow video input in Windows Sandbox	Windows 11
Sandbox	Computer	Allow printer sharing with Windows Sandbox	Windows 11
Sandbox	Computer	Allow clipboard sharing with Windows Sandbox	Windows 11
WindowsUpdate		<Changes in folder structure>	Windows 11

ADMX name	Scope	Setting	Available only in
DataCollection	Both	Allow Telemetry: Enhanced	Windows 10
DeliveryOptimization	Computer	Download Mode: Bypass	Windows 10
EAIME	User	Turn on Live Sticker	Windows 10
EAIME	User	Turn on lexicon update	Windows 10
InetRes	Both	Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects	Windows 10
InetRes	Both	Reset zoom to default for HTML dialogs in Internet Explorer mode	Windows 10
MicrosoftEdge	Both	Suppress the display of Edge Deprecation Notification	Windows 10
Printing	Computer	Limit print driver installation to Administrators	Windows 10
TerminalServer	Computer	Set the Remote Desktop licensing mode: AAD per User	Windows 10
WindowsDefender	Computer	Scan packed executables	Windows 10

Further resources you might find useful:

GPO Settings Reference Spreadsheet for Windows 10 21H2

https://www.microsoft.com/en-us/download/details.aspx?id=103668

GPO Settings Reference Spreadsheet for Windows 11 21H2

https://www.microsoft.com/en-us/download/details.aspx?id=103506

ADMX templates for Windows 10 21H2

https://www.microsoft.com/en-us/download/details.aspx?id=103667

ADMX templates for Windows 11 21H2

https://www.microsoft.com/en-us/download/details.aspx?id=103507

Edit 03/02/22: Please note that the list of differences shown above may not be complete. This is just a guiding reference. Also, there may be updated ADMX versions, which change the number of differences between Windows 10 and Windows 11 ADMX in either way. The table above shows differences at time of writing this article.

Edit: 07/02/22: Re-wrote some parts of the article because it could be misunderstood.

Edit: 21/07/23: All differences have been compensated now. See blue box on top for more details.

[Malte]

quite bad if your company have W10 and 11 (e.g. due to transition phase)

[Karl_Wester-Ebbinghaus]

Thanks for your article @hewagen.

As a Senior IT expert helping customers with the transition, which includes maintaining their GPO my main questions / concerns are:

1. Why does Microsoft maintain two ADMX policy sets in the first place? The Windows 11 ADMX should contain all settings and should be highly compatible with Windows 10 21H2 or earlier supported versions. It baffles me to be honest.

2. Why is the Windows 10 21H2 kept being updated and the other Windows 11 21H2 ADMX not being updated for a long time now, and as such missing settings?
There is nothing worse than GPP or registry hacks imho if it is avoidable.

3. Microsoft should understand this approach is not feasible. Even more we now have no further SAC but GAC starting with 21H2, the efforts to combine the templates should be considered. The gap, as per example below, can only get worse. 

EXAMPLE:
@hewagen your table is missing a difference in both settings, the setting is (still) missing in Windows 11 ADMX, due them being pretty much outdated compared to the Windows 10 21H2 ADMX. The release of Windows 11 ADMX missed this change by 2 days a week only , which now cause uneccessary confusion.

References:
KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates (...

KB5005652—Manage new Point and Print default driver installation behavior (CVE-2021-34481) (microsof...

Set RestrictDriverInstallationToAdministrators using Group Policy

After installing updates released October 12, 2021 or later, you can also set RestrictDriverInstallationToAdministrators using a Group Policy, using the following instructions:

1. Open the group policy editor tool and go to Computer Configuration > Administrative Templates > Printers. 

2. Set the Limits print driver installation to Administrators setting to "Enabled". This will set the registry value of RestrictDriverInstallationToAdministrators to 1.

[Karl_Wester-Ebbinghaus]

@hewagen what's also missing in the Windows 11 ADMX is the OS filtering option.

It ends with Windows 10.

When you open the GPMC and edit a GPO or local GP Editor you can right click on ADMX templates (in central store or local) and use a very sufficient filter, which has been maintained for decades now.

Windows 11 is the exception. There's no new OS category for this OS.

Can you please ask the team why we cannot filter for Windows 11 anymore if the Windows 11 ADMX introduced OS build specific settings?

In practice the central store is used to manage Windows Server and Windows Client OS, no matter the version, starting with XP/2003 or Vista/2008.

This should not been changed. The workaround in the blog is not helpful for common management scenarios.

Generally admins should not use their own devices to execute management tasks but a seperate host and user dedicated to these elevated tasks.

[Pascal_Tieg]

What a mess. It's gonna be a pain to manage both worlds (Win10 & 11) in transition phase. 

Microsoft you can do better.

[Pascal_Tieg]

Also, does this only effect Win10 & Win11? Or Server 2022 and below as well?

[Karl_Wester-Ebbinghaus]

@Pascal_Tieg depends on how you use it but by design of using Central Store for ADMX, it does affect Windows Server as well as I've outlined above.

[Pascal_Tieg]

@Karl_Wester-Ebbinghaus Yeah, that's what I figured. Just would love to have it confirmed by MS. 

[frozenak]

What about those of us using AGPM for change control, history, auditing, and delegation?

[Justin4567]

This is terrible.  Microsoft seems to lack any understanding or empathy for organisations trying to manage their products or they wouldn't introduce this mess. Do better Microsoft.

[Pascal_Tieg]

@hewagen Any feedback on above questions?

[SteveSta]

I'd like to echo all of the feedback above. Our org will be Win10 and Win11 for quite some time (as older TPM PCs that can't in-place upgrade exit the environment as they age out (attrition.)) This will make supporting both much more difficult.

Is there a technical reason that Win10 and Win11 ADMX files can't be a single ADMX file like Microsoft has done for years with past OSs? Thanks

[davidmbahm]

Wait "Limit print driver installation to Administrators" is only available in Windows 10? So that means Windows 11 can't apply that mitigation for PrintNightmare?!?

We ran a test on a domain W11 system and it could add a printer and install the driver as a regular user, thus showing that setting really is only W10. I can't find any online documentation for W11/PrintNightmare but this leads me to believe it would be vulnerable?

[ajc196]

As time goes on and environments get more and more mixed, this will be insanely confusing and borderline untenable in large environments with many complex GPOs. We already have enough things to worry about between testing patches for Microsoft (see January updates), researching and mitigating a never-ending flood of vulnerabilities, etc.

What possible explanation could there be to not have one set of templates, and Win11-exclusive settings simply having a Requirement of "Windows 11". You know, exactly how Windows 10 was handled?  If there's conflicts, move older settings to a "Legacy Settings" subfolder, exactly like was done with Windows Updates' settings in recent ADMX templates.

This is a tone-deaf decision that I think Microsoft should reconsider.

[Andrew Johnson]

I can't believe what I've just read...

This looks to me a further sign that Windows 11 is not a real candidate for serious Enterprise deployment yet.  Don't even get me started on the Teams shortcut debacle.

Please fix this, as in its current state it's basically broken.

[Karl_Wester-Ebbinghaus]

@davidmbahm if you deployed all CUs per default there is not much vulnerability left.

As everything is now effective by default.

However you might need this GPO for certain drivers that are package but still need admin rights even with point and print etc. 

The Windows 11 ADMX is missing the GPO yes. It's only in the Windows 10 21H2 ADMX. For Windows 11 you need to deploy a registry GPP.

This is slower and more prone to errors.

[Hrvoje Kusulja]

@WindowsTeam please fix this !!!

[lforbes]

This article seems to be completely misleading and seems incorrect from my testing?

The Windows 11 21H2 ADMX/ADML files linked above AND the Windows 11 ADMX/ADML files included with the Win11 Enterprise Operating System in C:\Windows\PolicyDefinitions all dated June 5th, 2021 install fine on Windows 10 1909 or newer into C:\Windows\PolicyDefinitions (you have to take ownership as an admin) and you can run gpedit.msc and clearly see the new Start Menu setting listed for Win11 only. Also all the previous Windows 7, Windows 8, Windows 10 settings are included.

If you do a side by side compare between the Windows 11 ADMX files and the Windows 10 20H2 files you can see they are identical with the exception of the very few new policies for Windows 11.

If you update all the ADMX and the ADML on the Sysvol Central store, with the new June versions, they run without errors and can be seen and applied in Group Policy Management to Windows 10 and Windows 11?

If you run mmc.exe and RSOP on Windows 11 or Windows 10 the policies apply equally to both OS.

[hewagen]

Hi @ll,

thanks for your feedback. Sorry for the delayed response and for not answering the questions above. I'm not part of the Windows product group so I don't know when this issue will be addressed. Anyway, I just wanted to point out that there are differences between the two ADMX versions (at the point of writing the article) but there is an "easy" workaround to get it solved. I most cases you won't even notice them because more than 99% of the settings within the ADMX are equal.

But I'm with you when you say that this can cause additional "trouble" in rare cases. I ran into this issue at one of my customers as well. I will try to contact the PG to get information if this will be fixed (and when) unless it's done on purpose. I will comment here.

Thanks,
Helmut

[Andrew Johnson]

Thanks for taking the time to reply @hewagen and I hope you receive some better news for us from the Product Group for in the future!

[Karl_Wester-Ebbinghaus]

Thank you Helmut for your reply and picking up the feedback @hewagen !

[lforbes]

---

@hewagen wrote:

• Hi @ll,

  thanks for your feedback. Sorry for the delayed response and for not answering the questions above. I'm not part of the Windows product group so I don't know when this issue will be addressed. Anyway, I just wanted to point out that there are differences between the two ADMX versions (at the point of writing the article) but there is an "easy" workaround to get it solved. I most cases you won't even notice them because more than 99% of the settings within the ADMX are equal.

  But I'm with you when you say that this can cause additional "trouble" in rare cases. I ran into this issue at one of my customers as well. I will try to contact the PG to get information if this will be fixed (and when) unless it's done on purpose. I will comment here.

  Thanks,
  Helmut

---

Hi,
I think you need to re-write your article because it is being repeated across multiple news sources and the information it is providing is incorrect in as how it is being interpreted.

I just confirmed with multiple Domain Admins that the ADMX for Windows 11 21H2 are backwards compatible to even Windows 7 they way they have always been. 

Reading the article again I think what you are trying to say is that Microsoft released a "new version" for Windows 10 that has settings not included in their "new version" for Windows 11 which to me is a case of when two OS developers are not talking to each other. They should merge the two and fix it for sure but as about 99.9% of those settings are probably not used, it isn't a huge big deal. You can just use a preference if you need to.

You can also mix and match the ADMX files. Microsoft keeps them separately for a reason. I am still running the ADMX/ADML from Windows 7 days for the Bitlocker Encryption settings because we still use Active Directory to store and Group Policy to set Bitlocker and the newer ADMX/ADML have had the settings removed.

The only rule is to keep the ADMX and ADML matched.

[lforbes]

K_Wester-Ebbinghaus

"what's also missing in the Windows 11 ADMX is the OS filtering option.

It ends with Windows 10.

When you open the GPMC and edit a GPO or local GP Editor you can right click on ADMX templates (in central store or local) and use a very sufficient filter, which has been maintained for decades now."

Are you running the Group Policy Management on a Windows 11 computer?  With Windows 10 you had to run it on Windows 10 to see the Windows 10 filtering. I remember because we had Windows 7 and had to spin up VM's for Win10 when it first came out in order to do the Filtering for the new OS.

I haven't checked my Win11 VM for filtering yet but I can when I am back at work.

[lforbes]

frozenak

 What about those of us using AGPM for change control, history, auditing, and delegation?

I use AGPM on Windows 11 and it works just fine. You still need .Net 3.5 and APGM version 3 which is the latest but it makes no difference. I have the ADMX for 21H2 from my Win11 box up on our Central store and they work just like they did previously. We still run Enterprise Win 7 (vendors for hospitals taking too long to support Win10) and GPOs are still working for Win7 too.

[hewagen]

@lforbes You might be right. Reading through this again it can be misunderstood. I will add another note to the beginning of the article to clarify. Thanks for your feedback.

[lforbes]

So K_Wester-Ebbinghaus is correct.

Windows 11 Computer running Group Policy Management and Windows 11 is MISSING the Operating System Edition.
Note that Server 2022 is there and that was just released.
Note that this is a flaw in Windows 11 OS, not in the ADMX templates. This OS version is part of the Group Policy Management Console itself not in the ADMX.

If I logon to the Windows 11 and open my Policy and go to Targeted Pref, I get Windows 10, no Windows 11 and Server 2022 but NOT Server 2019???

If I open the EXACT same policy and same Preference on Windows 10, I get Windows 10, Server 2019 Family, missing Windows 11 but that is to be expected.

[frozenak]

@lforbes So how do you control those Win10 policies that are only available in the Win10 policies, per this very post?

[Mirza Dedic]

In our enterprise we run latest Windows 10 Enterprise and we heavily use latest GPO/ADMX. Migrating to Windows 11 is going to be very much transitional spread over a year. Based on this post, it sounds like you can either have Windows 10 or Windows 11 ADMX templates, this is madness.

What is someone supposed to do if they want to manage both Windows 10 and Windows 11 fleet of computers? 

The only option I see here is to start using Intune (MECM co-managed and specific workloads moved to Intune for W11) for all things GPOs for Windows 11, and ensure all existing on-premise GPOs are only being applied to Windows 10 computers so the two do not mix.

Anyone have any other solution to this mess?

[Kalimanne J]

Maybe this will be solved with 22H2 having everything combined into one template.

Could they be stupid enough to keep with separate incompatible templates going forward?

[RonaldRossi]

Is it me or is everyone else tired of having to tweak everything to get it to run after another Microsoft screw up?
What Genius thought this was a good idea? Had an issue with inetres missing a setting and hunted this mess down, well thank you MSFT for another debacle
Anyone who thinks this is OK does not live in the real world where we try to keep businesses running and secure
Since inception of the Central Store the latest ADMX files would naturally manage the previous OS
Since Windows 10 there have been numerous errors in the deployment of the latest ADMX files
Someone has to do a better job, or find someone that can, this is not that difficult

[Karl_Wester-Ebbinghaus]

@hewagen do you have any news if the small discrepancies between the newer ADMX for Windows 10 21H2 will be matching Windows 11 21H2?

Any news from the PG? I have to disagree it's a rare condition. (unless you assume no one is either using both OS, or using Intune instead). 

Maybe you think it's rare, but the fact win 11 admx Urge you to implement printing nightmare via GPO GPP registry while natively included in Windows 10 is odd

We want to help customers to be consistent. 

@lforbes  thanks for testing, but it's the wrong area. 

You are looking into GPP conditions for a GPO GPP. 

You are right about the behaviour, because it is WMI based. 

I am talking about filters in GPMC ADMX, please check my detailed report and screenshot. Let me know if anything is unclear.

Hi @Jeremy Moskowitz as designated expert and MVP, do you have time so we could schedule a meeting with the PG to get this improved for Windows 11 22H2?

[hewagen]

Hi all,

the topic found its way to the PG. They're working on it. I don't have any further details for now but there is movement.

Thanks!

[Karl_Wester-Ebbinghaus]

Thank you for your quick follow up. Much appreciated Helmut, also for forwarding the feedback. 

[Jeremy Moskowitz]

First: I am ALWAYS available to the PG at anytime. :) PG just reach out to me as you see fit and happy to help.

I do agree that the MISSING Windows 11 in GPPRefs Item Level Targeting is completely bonkers. That has to be rectified. It can be worked around by WMI query, but it really should be fixed.

I also agree the myriad of issues is starting to pile up for regular customers and its possible a few small tweaks could re-right the ship for thousands of normal microsoft customers.

With that.. again; happy to help here.

[Karl_Wester-Ebbinghaus]

Hi @hewagen how are you have you heard back from the Product Group. 

We now have a new release for Windows 10 21H2 ADMX, while Windows 11 sticks on the outdated based. Doesn't make any sense in production.

Win 10 from 2022

https://www.microsoft.com/en-us/download/details.aspx?id=104042

Win 11 from 2021

https://www.microsoft.com/en-us/download/details.aspx?id=103507

[hewagen]

Unfortunately I do not have any news yet. The PG is still working on it.

[lforbes]

Hi,

So this is what I did today. I downloaded the V2 of Windows 10, 21H2 and then I just added the ADMX/ADML from the Windows 11 package where the Windows 11 ones had newer settings I wanted.

I opened both in Notepad++ and did a "Compare". 

I used the grid above to identify any policies I would use like the Chat one for Taskbar and the Register DNS Securely one.

I just copied over the ones that I wanted like DNSClient.admx/adml and the Taskbar.admx/adml that had the newer settings but the older dates.

So I created a folder of the best of each and I used that on my Servers.

They worked just fine and they open fine and I can set the settings and they apply to both our Windows 10 and Windows 11 computers as well as our older Windows 7 ones (Yes we have the extended license for some Hospital Applications that are very expensive) 

[Karl_Wester-Ebbinghaus]

@lforbes would you mind sharing this on github? so, one could download but also track the changes made?

[Kalimanne J]

I see that Windows 11 22H2 ADMX templates have been available for some time.

Is this issue solved with the Windows 11 22H2 templates or is the same incompatibility issue going to happen again when the Windows 10 22H2 ADMX templates are released?

[hewagen]

I haven't heard anything from the PG till now. Going to wait until Win 10 22H2 RTMs, to do another comparison between the templates. 

[Karl_Wester-Ebbinghaus]

Thanks for the follow up. From what I heard regarding the security baseline Team there will be still different ADMX for each OS in 22H2. So will they publishing different baselines aswell.

Some things mentioned before should have been improved though. (printingnightmare settings) 

[hewagen]

As announced already, I'm currently preparing a comparison with the 22H2 releases. This will be a new post going online on early January.

[Graham_Charles]

"Apps and Features" is not present in the Start button context menu.

[Karl_Wester-Ebbinghaus]

Here are the follow up blog posts. Cheers @hewagen !

Which ADMX to prefer Windows 10 or Windows 11

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-or-windows-11-gpo...

Windows 10 / 11 22H2 ADMX - Update

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-or-windows-11-gpo...

[Malte]

It seems Windows 11 GPO still miss a setting for TLS 1.3 in
Windows Components/Internet Explorer/Internet Control Panel/Advanced Page > Turn off encryption support > Secure Protocol combinations

[Malte]

Finally
Windows 11 GPO got a setting for TLS 1.3 in latest preview Patch March 23
https://support.microsoft.com/en-us/topic/march-28-2023-kb5023778-os-build-22621-1485-preview-d490bb...

"This update affects the Group Policy Editor. It adds Transport Layer Security (TLS) 1.3 to the list of protocols that you can set."

[Kalimanne J]

How would AGPM work if you have Windows 10 ADMX templates in your central store and Windows 11 ADMX templates on a workstation with the registry hack configured to bypass the central store?

I saw the earlier post that said AGPM can be installed on a Windows 11 system, but that isn’t my question.

Is there an issue with AGPM working with local stores on some systems and the central store on other systems at the same time?

[kechezhijia]

thanks

[Kalimanne J]

Can Windows 11 ADMX templates be managed from a Windows 10 workstation or does the admin workstation running GPMC with the registry hack use local templates also need to be Windows 11?

[hewagen]

You need a Win 11 workstation with GPMC (RSAT) installed. Then add the registry setting and modify your domain policy settings from that workstation.

[Kalimanne J]

@hewagen Will you be able to use AGPM using the local Windows 11 ADMX templates while everyone else is using the same AGPM instance with Windows 10 templates from the AD central store?