Normally the best practices is to download the latest version of your Policy Definitions and copy all the .admx files and .adml files for all languages that are enabled to the Policy Definitions folder on the Windows domain controller central store.
If you are not aware with the central store concept check this out :
| Downloads of the current GPO can be found here : ADMX Templates for Windows 10 November 2021 Update [21H2] can be found here https://www.microsoft.com/en-us/download/details.aspx?id=103667 ADMX Templates for Windows 11 October 2021 Update [21H2] can be found here :https://www.microsoft.com/en-us/download/details.aspx?id=103507 TIP : Nice help page about GPO https://admx.help |
After this copy and before Windows 11 you we’re done and was able to configure all the new (and older) settings in the Group Policy editor because of the backward compatibility.
This is not the case anymore with Windows 11 !! I know this is pretty BAD.
From now on it’s possible that new Windows 10 features are not available in Windows 11 ADMX files and that features of Windows 11 are not available in Windows 10 policies.
What to do in a mixed Windows 10 and Windows 11 environment ?
As you maybe aware of, It’s only possible to copy one set of ADMX files to your Domain Central Store so we have to choose between windows 10 or windows 11 .admx files.
Depending on your install base you should decide which templates fits best in your environment and place them in the central store.
If most of your clients are Windows 10 I would advise to choose the Windows 10 .admx files in your central store.
If you are in a migration phase from Windows 10 to Windows 11 it’s a more difficult choice.
I recommend to go for the Windows 11 ADMX files and in the case there is a Windows 10 setting that is not manageable via the W11 GPO you could use a registry key (via extensions).
What about GPO management in a mixed environment ?
When the Central store contains Windows 11 ADMX files it’s still possible to configure Windows 10 policy settings. You just need a separate management workstation with the latest Windows 10 version.
- Deploy a domain joined Windows 10 client.
- Install the RSAT Group Policy Management Tools
- Enable Local Store Override.
Your GP edit tools will use the ADMX/ADML files found under c:\windows\policydefinitions instead of the Central Store.
To achieve this you have to set this registry key by hand or use powershell to set this key :
Registry Editor and add following registry value:
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy
Value: EnableLocalStoreOverride
Type: REG_DWORD
Data: 1New-ItemProperty-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy"-Name EnableLocalStoreOverride -Type DWORD -Value 1|Out-Null- After installation restart the PC.
- Log in with sufficient rights and start Group Policy Management.
Create or edit a GPO object. It should open the object from the local store, check “…. retrieved from local computer”
This blog does a good comparison between Group policies for Windows 11 and 10 21H2 https://4sysops.com/archives/group-policies-for-windows-11-and-10-21h2-compared/
More information can be found here :
Group Policy Settings Reference Spreadsheet for Windows 10 November 2021 Update [21H2]
https://www.microsoft.com/en-us/download/details.aspx?id=103668
Group Policy Settings Reference Spreadsheet for Windows 10 November 2021 Update [21H2]
https://www.microsoft.com/en-us/download/details.aspx?id=103668
Group Policy Settings Reference Spreadsheet for Windows 11 October 2021 Update (21H2)
https://www.microsoft.com/en-us/download/details.aspx?id=103506
What’s new in Windows client deployment
https://docs.microsoft.com/en-us/windows/deployment/deploy-whats-new
Understanding ADMX policies
https://docs.microsoft.com/en-us/windows/client-management/mdm/understanding-admx-backed-policies
Whats new in GPO
What’s New Group Policy Settings Available In Different Versions Of Windows 10 – HTMD Blog #2 What’s New Group Policy Settings Available In Different Versions Of Windows 10 – HTMD Blog #2 (howtomanagedevices.com)
Group Policy Settings Reference Spreadsheet for Windows 10 May 2021 Update (21H1)
Download Group Policy Settings Reference Spreadsheet for Windows 10 May 2021 Update (21H1) from Official Microsoft Download Center
Windows 10 21H2 and Windows 11 21H2 ADMX files differences.
| ADMX name | Scope | Setting | Available only in |
| AppPrivacy | Computer | Let Windows apps take screenshots of various windows or displays | Windows 11 |
| AppPrivacy | Computer | Let Windows apps turn off the screenshot border | Windows 11 |
| AppxPackageManager | Computer | Archive infrequently used apps | Windows 11 |
| AppxPackageManager | Computer | Do not allow sideloaded apps to auto-update in the background | Windows 11 |
| AppxPackageManager | Computer | Do not allow sideloaded apps to auto-update in the background on a metered network | Windows 11 |
| CloudContent | Computer | Turn off cloud consumer account state content | Windows 11 |
| CloudContent | User | Turn off Spotlight collection on Desktop | Windows 11 |
| ControlPanelDisplay | Computer | Prevent lock screen background motion | Windows 11 |
| DataCollection | Computer | Limit Diagnostic Log Collection | Windows 11 |
| DataCollection | Computer | Limit Dump Collection | Windows 11 |
| DeliveryOptimization | Computer | Discovery Mode: Local Discovery | Windows 11 |
| DnsClient | Computer | Configure DNS over HTTPS (DoH) name resolution | Windows 11 |
| EAIME | User | Configure Korean IME version | Windows 11 |
| FileSys | Computer | Enable NTFS non-paged pool usage | Windows 11 |
| FileSys | Computer | NTFS parallel flush threshold | Windows 11 |
| FileSys | Computer | NTFS parallel flush worker threads | Windows 11 |
| FileSys | Computer | Configure NTFS default tier | Windows 11 |
| Globalization | Both | Restrict Language Pack and Language Feature Installation | Windows 11 |
| InetRes | Both | Replace JScript by loading JScript9Legacy in place of JScript via MSHTML/WebOC. | Windows 11 |
| Netlogon | Computer | Use lowercase DNS host names when registering domain controller SRV records | Windows 11 |
| NewsAndInterests | Computer | Allow News and Interests | Windows 11 |
| Sam | Computer | Configuration settings for the Security Account Manager | Windows 11 |
| Sensors | Computer | Force instant Wake | Windows 11 |
| Sensors | Computer | Force instant Lock | Windows 11 |
| Sensors | Computer | Configure Lock Timeout | Windows 11 |
| StartMenu | Both | Locked Start Layout: Re-Apply Layout at every logon | Windows 11 |
| StartMenu | Both | Show or hide “Most used” list from Start menu | Windows 11 |
| TaskBar | Computer | Configure the Chat icon on the taskbar | Windows 11 |
| TenantRestrictions | Computer | Configure Cloud Policy Details | Windows 11 |
| TerminalServer | Computer | Enable auto-subscription | Windows 11 |
| TerminalServer | Computer | Do not allow location redirection | Windows 11 |
| TerminalServer | Computer | Allow UI Automation redirection | Windows 11 |
| WindowsDefender | Computer | Configure scheduled task times randomization window | Windows 11 |
| WindowsDefender | Computer | Define the directory path to copy support log files | Windows 11 |
| WindowsDefender | Computer | Configure IP Address Exclusions | Windows 11 |
| WindowsDefender | Computer | Turn on script scanning | Windows 11 |
| WindowsDefender | Computer | Allow Microsoft Defender Antivirus to update and communicate over a metered connection | Windows 11 |
| WindowsDefender | Computer | Configure Network Protection to be allowed to be configured into block or audit mode on Windows Server | Windows 11 |
| WindowsDefender | Computer | Control datagram processing for network protection | Windows 11 |
| Sandbox | Computer | Allow vGPU sharing for Windows Sandbox | Windows 11 |
| Sandbox | Computer | Allow networking in Windows Sandbox | Windows 11 |
| Sandbox | Computer | Allow audio input in Windows Sandbox | Windows 11 |
| Sandbox | Computer | Allow video input in Windows Sandbox | Windows 11 |
| Sandbox | Computer | Allow printer sharing with Windows Sandbox | Windows 11 |
| Sandbox | Computer | Allow clipboard sharing with Windows Sandbox | Windows 11 |
| WindowsUpdate | <Changes in folder structure> | Windows 11 |
| ADMX name | Scope | Setting | Available only in |
| DataCollection | Both | Allow Telemetry: Enhanced | Windows 10 |
| DeliveryOptimization | Computer | Download Mode: Bypass | Windows 10 |
| EAIME | User | Turn on Live Sticker | Windows 10 |
| EAIME | User | Turn on lexicon update | Windows 10 |
| InetRes | Both | Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects | Windows 10 |
| InetRes | Both | Reset zoom to default for HTML dialogs in Internet Explorer mode | Windows 10 |
| MicrosoftEdge | Both | Suppress the display of Edge Deprecation Notification | Windows 10 |
| Printing | Computer | Limit print driver installation to Administrators | Windows 10 |
| TerminalServer | Computer | Set the Remote Desktop licensing mode: AAD per User | Windows 10 |
| WindowsDefender | Computer | Scan packed executables | Windows 10 |
great post