Fixing Administrative Template policy setting problems

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

This topic highlights issues related to processing of the Administrative Templates extension, also known as the registry extension.

Administrative Templates

Administrative Template settings take the form of true policies or preferences. Preferences can be deployed using Group Policy, but they cannot be enforced to the same degree as true policies. For this reason they are hidden by default in the Group Policy Object Editor.

Users can change preferences, but they cannot change true policies.

True policies are more secure because they are stored in secured registry hives.

Changes to true policies override but do not overwrite user preferences. If the policy is later removed, the user setting will again prevail.

If the GPO ceases to apply to the user or computer, policies no longer apply but preferences remain. This occurs if the user or computer moves out of the site, domain, or OU that the GPO is linked to, or if the GPO is deleted.

If the setting you are using is a preference rather than a true policy be aware that because preferences can be overwritten but are not removed, the end user might see their behavior as unpredictable. As a result, there might be perceived problems even when preferences are behaving as intended. Troubleshooting preferences requires knowledge about changes to both the GPO and the preferences set by the user.

The registry CSE writes the value for the setting to the registry. Some settings take effect as soon as they are written to the registry, but others take effect only at startup or logon. If you are not seeing the expected results and the Group Policy Results report shows that the policy has been applied, restart the computer or log off and log back on.