GptTmpl.inf and Service Pack or Update

[Guest]

We have a lot of custom Group Policy settings
(http://www.jsiinc.com/SUBN/tip6500/rh6550.htm) in our AD 2003 environment.
We manually modify the "GptTmpl.inf" to implement those custom settings. My
concern is what will happen if I install a new Service Pack? Will it keep my
custom settings or overwrite with the default one?

Thanks in advance!

 

[Darren Mar-Elia]

Sari-
First off, modifying that file directly is bad news. Not coincidentally, the
KB article that that tip refers to is no longer on Microsoft's site. If you
need to disable inheritance on a file security policy, you should be able to
do anything you need to do through the UI. Also, its not clear where you are
modifying this file. Are you doing it within the GPT data for that GPO on
SYSVOL or against the local machine? If the latter, then any changes you
make there will be overwritten by conflicting domain-based GPO changes.

 

[Guest]

Thanks for the quick response. We are modifying the Domain Policy. The file
is located here

C:\WINDOWS\SYSVOL\sysvol\qcorpaa.aa.com\Policies\{XXXX-1D95-4XXX2-XXXEE-733C89XXX9CE}\Machine\Microsoft\Windows NT\SecEdit

 

[Guest]

I am trying to enable “Admin tool for all the users†How do I do it through
group policy? I didn’t see any built-in option in the GPO. So I have to
manually edit the “inf†file.

 

[Darren Mar-Elia]

Sari-
You'll need to be more specific on which policy you are trying to implement.
What do you mean by "Admin tool for all the users"?

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related

 

[Guest]

I am trying to do this using GPO

http://www.jsiinc.com/SUBN/tip6500/rh6550.htm

thanks

 

[Darren Mar-Elia]

So you are trying to change file or folder inheritance on which files or
folders?

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related

 

[Guest]

Sorry.. This is what i am tring to do

http://www.jsiinc.com/SUBI/tip4400/rh4498.htm

 

[Darren Mar-Elia]

Ok, so you want to create a custom ADM for this. You don't need or want to
edit gpttmpl.inf--its the wrong place to make this change. Check out this
doc:
http://www.microsoft.com/technet/pr...er2003/technologies/management/gp/admtgp.mspx

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related

 

[Guest]

Thanks again.. But can you explain why it is the wrong place to make this
change?

 

[Darren Mar-Elia]

Sure. Gpttmpl.inf is used to *store* security policy settings. It holds the
settings that you deploy via security policy within Group Policy. There is a
way to customize the "Local Options" section of security policy to set other
registry values. This is done by editing the file called sceregvl.inf found
on the machine from where you edit the GPO in the %windir%\inf. This is
described here:
http://support.microsoft.com/default.aspx?scid=kb;en-us;214752. So, directly
editing gpttmpl.inf is not the way to do this if you really need to
customize these options. You modify sceregvl.inf instead and then use that
to make the change through the GP editor. However, this is designed to
customize security values, not for general registry changes made through
policy. That is exactly what ADMs are designed for.

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related