newbie: question to system.adm

[tim moor]

dear gpo-ng
to lockdown a terminalserver i have to hide drive m: and n: on the server.
this can be done by customizing the
hidedrives-policy in the system.adm.
is it correct to make this changes directly in the system.adm
(c:\windows\inf) or should i prefer to create a new adm-template ?
supposed i create a new 'hidedrive.adm', does it conflict with the settings
in the original system.adm. thank you for a hint.

tim

 

[Mark Renoden [MSFT]]

Hi Tim

I believe this answers your question:

231289 Using Group Policy Objects to hide specified drives in My Computer
for
http://support.microsoft.com/?id=231289

Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Darren Mar-Elia]

This KB article talks about editing the system.adm file directly. My
recommendation would be to not do that. The reason I say that is, the next
time Microsoft comes along with a new system.adm, it will likely overwrite
your customizations, and essentially orphan them (the settings will still be
there in the policy, but you won't see them anymore). So, I would copy that
section of the system.adm file into your own custom ADM (using the
whitepaper referenced in that KB article as a guide to writing custom ADMs)
and take out the drive combinations that system.adm provides and just leave
your own combinations in. Then, change the strings to have the new custom
ADM settings appear in a different part of the Admin Template Namespace (I
usually put mine under something like "My Custom Registry Stuff" or "My
Company"). That way, they are clearly delineated and won't easily be lost 6
months from now when you update the base ADMs.


--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related

Hi Tim

I believe this answers your question:

231289 Using Group Policy Objects to hide specified drives in My Computer
for
http://support.microsoft.com/?id=231289

Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no
rights.

dear gpo-ng
to lockdown a terminalserver i have to hide drive m: and n: on the
server.
this can be done by customizing the
hidedrives-policy in the system.adm.
is it correct to make this changes directly in the system.adm
(c:\windows\inf) or should i prefer to create a new adm-template ?
supposed i create a new 'hidedrive.adm', does it conflict with the
settings
in the original system.adm. thank you for a hint.

tim

 

[Mark Renoden [MSFT]]

Hi

It says you can but suggests you shouldn't.

Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no rights.

This KB article talks about editing the system.adm file directly. My
recommendation would be to not do that. The reason I say that is, the next
time Microsoft comes along with a new system.adm, it will likely overwrite
your customizations, and essentially orphan them (the settings will still
be there in the policy, but you won't see them anymore). So, I would copy
that section of the system.adm file into your own custom ADM (using the
whitepaper referenced in that KB article as a guide to writing custom
ADMs) and take out the drive combinations that system.adm provides and
just leave your own combinations in. Then, change the strings to have the
new custom ADM settings appear in a different part of the Admin Template
Namespace (I usually put mine under something like "My Custom Registry
Stuff" or "My Company"). That way, they are clearly delineated and won't
easily be lost 6 months from now when you update the base ADMs.


--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information
Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related

Hi Tim

I believe this answers your question:

231289 Using Group Policy Objects to hide specified drives in My Computer
for
http://support.microsoft.com/?id=231289

Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no
rights.

dear gpo-ng
to lockdown a terminalserver i have to hide drive m: and n: on the
server.
this can be done by customizing the
hidedrives-policy in the system.adm.
is it correct to make this changes directly in the system.adm
(c:\windows\inf) or should i prefer to create a new adm-template ?
supposed i create a new 'hidedrive.adm', does it conflict with the
settings
in the original system.adm. thank you for a hint.

tim

 

[tim moor]

darren,
thank you for your posting. as my english-knowledge is quit weak i'd like
to repeat your suggestion:

1. create a new custom adm file (example: hidedrive.adm)
2. in this adm file i create a new category (example: "Ts_HideDrive") with
my own combinations of the drives i want to hide)
3. i remove the 'HideDrives' section in the original distributed system.adm
4. i import this new adm template

is this correct ?

thank you very much
tim

This KB article talks about editing the system.adm file directly. My
recommendation would be to not do that. The reason I say that is, the next
time Microsoft comes along with a new system.adm, it will likely overwrite
your customizations, and essentially orphan them (the settings will still be
there in the policy, but you won't see them anymore). So, I would copy that
section of the system.adm file into your own custom ADM (using the
whitepaper referenced in that KB article as a guide to writing custom ADMs)
and take out the drive combinations that system.adm provides and just leave
your own combinations in. Then, change the strings to have the new custom
ADM settings appear in a different part of the Admin Template Namespace (I
usually put mine under something like "My Custom Registry Stuff" or "My
Company"). That way, they are clearly delineated and won't easily be lost 6
months from now when you update the base ADMs.


--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related

Hi Tim

I believe this answers your question:

231289 Using Group Policy Objects to hide specified drives in My Computer
for
http://support.microsoft.com/?id=231289

Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no
rights.

dear gpo-ng
to lockdown a terminalserver i have to hide drive m: and n: on the
server.
this can be done by customizing the
hidedrives-policy in the system.adm.
is it correct to make this changes directly in the system.adm
(c:\windows\inf) or should i prefer to create a new adm-template ?
supposed i create a new 'hidedrive.adm', does it conflict with the
settings
in the original system.adm. thank you for a hint.

tim