Viewing Group Policy Templates

The Group Policy Management Console reads ADMX files from the central store typically
 \\<domain.com>\sysvol\<domain.com>\Policies\PolicyDefinitions

which on a DC is

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions

If you want to view ADMX files before placing them in the central store, copy them to C:\Windows\PolicyDefinitions.  Copy the language files ADML files to the suitable subfolder.

Change this key to 1 then launch GPMC.  Editing a policy will read from the local ADMX files not the central store.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\EnableLocalStoreOverrideType: REG_DWORD
Values:
0 - Use PolicyDefinitions on Sysvol if present (Default)
1 - Use local PolicyDefinitions always

Updating central store

Install a downloaded MSI containing the ADMX/ADML files which may install to 

e.g. C:\Program Files (x86)\Windows Server 2022 August 2021 Update\Policy Definitions

On the DC

Copy the required ADMX policy template files to 

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions

Copy the the required ADML policy template files from the language specific folder e.g.

C:\Program Files (x86)\Microsoft Group Policy\Windows Server 2022 August 2021 Update\PolicyDefinitions\en-US

to 

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions\en-US

The Policy options provided by the templates will now be visible in Group Policy Management Editor

Mapping to Sharepoint folders

Useful article about mapping File Explorer and/or OneDrive to Sharepoint Folders

https://docs.microsoft.com/en-us/sharepoint/support/administration/troubleshoot-mapped-network-drives

Start Menu Locked grrrrrr

Why some sysadmins lock the start menu I don't know.  It just reduces productivity when users are unable to customize the area designed to allow quick launching of favourite apps.

So if you suspect there is a group policy locking this down try this.

1. Set this key to 0
   
   HKCU\Software\Policies\Microsoft\Windows\Explorer
   LockedStartLayout   REG_DWORD    0
   
   As a user you probably won't have permissions.  Elevate then edit the user key below the appropriate SID in HKEY_USERS
   
2. Use the task manager to End Process on explorer.exe
   
3. Then in task manager use File_Run New Task to re-launch explorer

You can now "Pin to Start" for as long as the GPO has not affected the current explorer session.  You would likely have to carry out the procedure again before you could "Pin to Start", after a reboot for example.

administrator has blocked you from running this app

Oh no! That's terrible.  It looks very serious.

I doubt just running it in an elevated command window would make much difference. Oh, it does!

Process Mitigation / Exploit Protection

Process Mitigation (PM)
Win 10 Exploit protection settings are displayed/controlled in Update & Security_Windows Security_App & browser control_Exploit protection settings.

Depending on the GPOs used the settings may or may not be visible or changeable within the user interface.

The powershell cmdlet Set-ProcessMitigation -system can be used to control the settings.  The results of these commands modify a registry key value

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\MitigationOptions

Settings for applications are stored here
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<AppName.exe>\MitigationOptions

Using get-processmitigation -system
Many of the PM settings display as NOTSET.  This means that they are at the OS default settings and may be ON or OFF.  Using the -RegistryConfigFilePath to export the settings to an XML file will not include any default system settings, only ones that have been specifically set.

Once Set-ProcessMitigation is used for any settings e.g. to set ON for a given setting, the only way to return to the original NOTSET state is to delete the MitigationOptions key above.

Set-ProcessMitigation only enables or disables settings, it cannot be used to return to the original OS default setting state NOTSET

In Windows 10 1803 and 1809 these are the OS default settings

Control Flow Guard (CFG)
Use default (On)

Data Execution Prevention (DEP)
Use default (On)

Force randomization for images (Mandatory ASLR)
Use default (Off)

Randomise memory allocations (Bottom-up ASLR)
Use default (On)

High-entropy ASLR
Use default (On)

Validate exception chains (SEHOP)
Use default (On)

Validate heap integrity
Use default (On)

Windows 10 Pro Optional Features Missing

Attempting to apply the XPS Viewer feature to a non domain Windows 10 1903 Pro install logged in as a local user results in no features available to select.

Settings_Apps & Features_Optional Features

At this point UAC prompts for elevation, enter the admin account credentials.

Some Optional Features appear along with an Add a feature button.

Click "Add a feature" and again and enter the admin credentials at the UAC prompt.

No features to install appears but it looks optimistic because there are spinning spots which seem to indicate that any minute now the features you are looking for will appear for selection.

But no.  These are not the features you are looking for, user scum.

The spinning spots stop and there is nothing.  Move along.

The problem here seems to be the UAC hand over to the admin credentials.

If you interactively logon as the administrator and carry out the same procedure, the features you are looking for will appear for your selection and installation delight.

Note: The RSATs are Windows 10 optional features but also available for download here
https://www.microsoft.com/en-us/download/details.aspx?id=45520

Office 365 channel change

A normal Office 365 download will default to monthly channel but Semi-Annual channel may be preferable.  To change the channel to Semi-Annual, run the following commands

1. Run CMD as Admin
Search for CMD and then right click on Command Prompt > click on Run as Administrator
2. Type
cd C:\Program Files\Common Files\Microsoft Shared\ClickToRun
Press Enter.
Type
OfficeC2RClient.exe /changesetting Channel=Broad
Press Enter.
Type
OfficeC2RClient.exe /update user
Press Enter.


Channel identity notes

Channel Keyword in CMD or ODT
Monthly Channel (Targeted) Channel = "Insiders" or Channel = "FirstReleaseCurrent"
Monthly Channel Channel = "Monthly" or Channel = "Current"
Semi-annual Channel (Targeted) Channel = "Targeted" or Channel = "FirstReleaseDeferred"
Semi-annual Channel Channel = "Broad" or Channel = "Deferred"

information from
https://answers.microsoft.com/en-us/msoffice/forum/all/to-change-update-channel-office-365/c1b70a1f-4741-4940-9d49-32e6e5607769