[Samba] Windows 10 administrative templates /central store with Samba

[Ole Traupe]

Viktor, I think we have a misunderstanding. And as this is no Samba 
issue, I'll try to contact you personally, if you don't mind.

In any way, thanks a lot for your help!
Ole


On 25.01.2016 19:01, Viktor Trojanovic wrote:
>
>
> On 25.01.2016 17:04, Ole Traupe wrote:
>>
>>
>> On 25.01.2016 14:13, Viktor Trojanovic wrote:
>>> Hi Ole,
>>>
>>> Unless you want to add functionality that is new since 1511, I don't 
>>> think that's necessary.
>>
>> I have already added a Win10 machine to a domain, where only Win7 
>> clients were joined before that. I have managed this domain from Win7 
>> only, so far. Therefore I believe that e.g. the Windows Update policy 
>> is not fit for Win10. Before today there was no central policy store.
>>
>> Ole
>
> No, this shouldn't be an issue. Whatever already worked while you 
> managed the policy using a Win7 machine will continue to work. That's 
> completely independent of the central store. Only if this specific 
> policy has some additional tweaks that only work on Windows 10, you 
> might profit from editing the policy again now to include those tweaks.
>
> I think you're still not fully understanding the purpose of the 
> central store. Every windows client contains a full set of 
> administrative templates, for its own version. So, on Windows 7 you 
> have a set for Windows 7, on Windows 10 you have a set for Windows 10, 
> and so on. The set for Windows 10 will always include everything that 
> Windows 7 had to offer, plus some additional functionality. So, that's 
> why you need to *either* run the RSAT from a Windows 10 machine if you 
> wish to manage Windows 10 (and other) clients in the domain, *or* you 
> put the templates in the central store and then you can manage Windows 
> versions that are higher than where you have installed RSAT.
>
> Hope it's clearer now :)
>
> Viktor
>
>>
>>
>>
>>>
>>> The main benefit you have with the central store is that you now 
>>> *can edit* GPOs with Win10-only-rules also on non-Win10-computers. 
>>> It does not, however, affect how the client implements the GPO.
>>>
>>> Viktor
>>>
>>> On 25.01.2016 12:36, Ole Traupe wrote:
>>>> Viktor, thanks again!
>>>>
>>>> Now that I did this (added the Win10 1511 ADMX files to the central 
>>>> store), I probably will have to recreate the policies that will be 
>>>> applied to Win10 machines, right?
>>>>
>>>> Ole
>>>>
>>>>
>>>> On 21.01.2016 17:16, Viktor Trojanovic wrote:
>>>>> Hi Ole,
>>>>>
>>>>> I've been using Samba with Win10 clients for a while now, so I'm 
>>>>> happy to share some of my findings.
>>>>>
>>>>> See comments inline.
>>>>>
>>>>> On 21.01.2016 15:39, Ole Traupe wrote:
>>>>>> Hi list,
>>>>>>
>>>>>> This might or might not be a Samba related post. Feel free to 
>>>>>> ignore it in case it is too far off-topic
>>>>>>
>>>>>> My current understanding is that ...
>>>>>> a) I need those new templates in order to fully integrate Win10 
>>>>>> clients in an AD domain (i.e. with compatible policies).
>>>>> As long as you have your RSAT installed on a Win10 machine, you 
>>>>> actually don't need to install the templates to the sysvol store. 
>>>>> The purpose of the template store is that multiple admins working 
>>>>> from various machines with different versions of windows can 
>>>>> always access all capabilities.
>>>>>
>>>>>> b) I can only modify policies based on Win10 admx files from 
>>>>>> Win10 machines (i.e. with the RSAT tools for Win10).
>>>>>>
>>>>> See above. The purpose of installing the ADMX to the central store 
>>>>> is that you can modify policies for Win10 also from a Win7 machine.
>>>>>
>>>>>> Are there any Samba-related implications or issues on doing that, 
>>>>>> particularly if I follow the MS advice to store those admx files 
>>>>>> in a central store in the SYSVOL (\PolicyDefinitions) folder?
>>>>>>
>>>>> I did that, and have no issues.
>>>>>
>>>>>> Also, are there any implications for existing domains with e.g. 
>>>>>> Win7 clients? Is it advised to keep Win7 and Win10 in separate 
>>>>>> containers?
>>>>>>
>>>>> No, there should be no issues. The only thing you have to remember 
>>>>> is that settings which are specific to Win10 will obviously not 
>>>>> have any effect on Win7 machines.
>>>>>
>>>>>> I remember that somebody here reported issues with his/her 
>>>>>> existing Samba domain after having used the RSAT tools for Win10. 
>>>>>> But I am not able to find this post again. Does somebody remember 
>>>>>> or is able to tell how to avoid such (or other) trouble?
>>>>>>
>>>>> No issues. I did report a few but eventually found out they were 
>>>>> not related to the RSAT, or to Samba.
>>>>>
>>>>>> Also, Viktor Trojanovic and Robert Watson reported the same error 
>>>>>> message on administering a domain from Win10 with RSAT in the 
>>>>>> midst of November. Have you been able to understand/solve it?
>>>>>>
>>>>>> "Group Policy Management: A processing error occured collecting 
>>>>>> data using this base domain controller. Please change the base 
>>>>>> domain controller and try again."
>>>>>
>>>>> You'll get that error message when you click on the domain in the 
>>>>> forest shown in RSAT. You can simply ignore it, it's not an actual 
>>>>> issue.
>>>>>> Ole
>>>>>>
>>>>>
>>>>> Viktor
>>>>
>>>
>>> -- 
>>> *Viktor Trojanovic*
>>> 076 391 80 80
>>
>
> -- 
> *Viktor Trojanovic*
> 076 391 80 80