Customizing Policy Settings With Active Directory Group Policy Objects

Note: The described procedure applies to Microsoft Windows Server 2008 or later.
Prerequisites: You must have Domain Administrator rights to deploy or modify GPOs.

You can use Active Directory Group Policy to centrally manage ActivClient configurations across a domain.

Note: GPO-deployed settings always take precedence over local configurations.

  • Configure ActivClient behavior centrally.

  • Push consistent settings to all users or machines in the domain.

  • Override any locally configured settings.

ActivClient provides several ADMX and ADML files used to define policy settings in the Group Policy Editor:

TemplateFfiles Purpose

HIDGlobal.admx (and HIDGlobal.adml)

 Defines the root HIDGlobal node under Administrative Templates, where all HID Global policy settings are organized.
HIDGlobal.ActivClient.admx (and HIDGlobal.ActivClient.adml Contains all ActivClient-specific settings. This node appears under the HIDGlobal root.
HIDGlobal.Logging.admx (and HIDGlobal.Logging.adml Contains general logging policies. This node is also located under HIDGlobal.

These files are installed with the Configuration Management component during ActivClient setup and copied to C:\Windows\PolicyDefinitions\.

Note: ActivClient's ADMX templates define policy structure and default behavior of the policies. To override the default behavior, you must explicitly configure each policy setting.

To set up the Group Policy Object (GPO) and configure policy settings, refer to the Microsoft documentation for the Group Policy Management Console.

Note: For instructions on installing a GPO or importing the ActivClient administrative templates, refer to the Microsoft documentation on importing administrative templates into Microsoft Intune.

Group Policy settings for computers are processed in the following order:

  1. Local

  2. Site

  3. Domain

  4. Organizational units

    Policies are applied from the highest OU in hierarchy to the lowest (i.e., the lowest OU setting takes precedence over higher ones).

    This means that the local Group Policy object is processed first, and Group Policy objects that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites the earlier Group Policy objects. See Microsoft documentation for more information.

Note:

  • Group policies are applied to the computer when they are connected to the domain. So even if a user logs on to Microsoft Windows offline, with cached domain credentials, the last group policy objects are applied and cannot be modified.

  • Group Policy refreshes policy settings at a regular interval, which is every 90 minutes by default. This value is configurable by a Group Policy administrator.

  • Group policy refresh can also be enforced by executing the command line gpupdate /force.