What’s Wrong with Group Policy
Over the years I have worked with Group Policy in many different ways. My experience ranges from helping an enterprise client establish a brand new set of policies for physical PCs and VDI machines to authoring ADM/ADMX/ADML files. Last year I presented and wrote a very detailed analysis of the impact of Group Policy on user logon performance (blog posts). Along the way I learned a lot about the strengths but also about the weaknesses of Group Policy. This article is an account of the latter.
Hubble’s High-Definition Panoramic View of the Andromeda Galaxy by NASA Goddard Space Flight Center under CC
Arcane UI
When you work with Group Policy you do that with Group Policy Management Console (GPMC) and Group Policy Object Editor (GPOE). GPMC was introduced with Windows Server 2003. It has not been updated in any significant way since then – that was 13 years ago.
What can I say? These tools work and they are even kind of functional. But they could be so much better.
Development / Roadmap
That brings me to the topic of ongoing development – which does not happen. Sure enough, every new version of Windows adds new Group Policy settings, and the number of client-side extensions increased from 9 in Windows 2000 to 47 in Windows 8.1 (source), but I am talking about the Group Policy engine here.
It would have been cool if Microsoft had gradually evolved Group Policy by adding management capabilities for devices not joined to a domain and potentially even for mobile devices. But that did not happen. The last significant improvement to Group Policy was the integration of Group Policy Preferences (GPP), a technology Microsoft acquired from DesktopStandard in 2006. This update came as part of Windows Vista.
Management / Documentation
Improvements would also have been nice in the area of managment, where Group Policy is lacking (even considering AGMP, the Advanced Group Policy Management extension which is part of MDOP which in turn requires Software Assurance).
The one big issue not even AGMP fixes is documentation. Change management has been a big thing for at least the past 10 years, yet even today there is no way to force administrators to document a Group Policy change in the one place where it makes sense: right in Group Policy Editor. Please note that I am talking about forcing admins to document a change (only if configured by the enterprise, of course). I am well aware of the fact that some Group Policy settings have a field for comments, but that is optional, and it is only available for registry-based policy settings (the classic Group Policy settings based on administrative templates).
Summing this up, if you want to document the reason why exactly each individual Group Policy setting is configured the way it is, you have to resort to Excel or similar. That sucks. Bigtime.
Group Policy Templates (ADMX/ADML)
Windows Vista brought a new templating engine for Group Policy. It is based on XML files, separated into content (ADMX) and presentation (ADML). So far, so good. Now comes the ugly part.
There is no authoring tool available, at least none that works (Microsoft’s ADMX Migrator is just plain horrible). If you are “lucky” and work for a software vendor who want to make their application configurable through Group Policy you will have to edit the ADMX/ADML files in a text editor.
Now, when you read the next sentences keep in mind this is coming from a guy who edits HTML (including this blog post) in a text editor. Okay, here we go:
Editing ADMX/ADML files is an experience you do not want to make. If you did, you do not want to repeat it.
’nuff said.
UI Capabilities
I already mentioned the arcane UI earlier. The following is geared towards people authoring ADMX files who have to squeeze their application’s rich configuration features into the confines of the capabilites of the Group Policy UI.
- No validation of user input possible
- Maximum value of the number field is 9,999. If you need bigger numbers you have to use a text input (resulting in REG_SZ).
- No UI layout options whatsoever
- No dependencies between fields (e.g. if this is enabled that needs to be enabled, too)
- List input is horrible
- Not many options for providing help to the user
Summary
Summing this up, Microsoft has not invested a single cent in Group Policy since Windows Vista. The UI ranges from arcane (for users) to horrible (for template authors). While the extensibility of Group Policy is a very big plus, you definitely do not want to be the person authoring the ADMX/ADMX files.
Management is severely impacted by the lack of documentation and change management features. As to the roadmap – what roadmap?
Should you use Group Policy?
Everybody does. It is well understood, scalable, extensible. Basically a good tool. If only there was evolution.
If you are looking for alternatives you might want to read Jeremy Moskowitz’ “Why Group Policy is Not Dead” manifesto.
2 Comments
This is a working ADMX editor: http://www.sysprosoft.com/adm_summary.shtml
I use it for about 6 years now, and it fully supports all ADMX schmema elements as well as multi language ADML files. Multiple values set with enabling one setting? No problem. Referenced ADMX parent files? No problem
Give it a try :-))
regards, Martin
PS: It is the _only_ working ADMX editor I’m aware of. MSFTs ADMX migrator AFAIK was bought from FullArmor, and the ADM editors integrated in NetIQ or Quest “GPOAdmin” products do not support ADMX.
HI, great article. I am a novice when it comes to Group Policy but I also noticed how its old and doesn’t seem to have been developed. I remember using Windows SteadyState and while many remember the ‘deep freeze’ functionality I also loved the admin features, it was extremely easy to use and even a lay person could edit it without much hesitation. Then you see something like the Group Policy editor and its a different story, its much harder for a newbie and if you use it only sparingly it can seem like a headache even though its immensely useful.
I recently found a free tool called Policy Plus (https://github.com/Fleex255/PolicyPlus), and its more functional than the built-in version, but for me the main reason why I like it is because it has search functionality, I can look for any setting using just a few key words, its just amazing. I still can’t understand why Microsoft can’t do that. Maybe others will find it useful too. I also read it is portable and can even be used on Home versions as long as the appropriate files are downloaded (use the option inside the program to do so)
I hope others also find it useful. I still miss the way SteadyState did it.