{"id":147,"date":"2019-02-28T11:40:52","date_gmt":"2019-02-28T11:40:52","guid":{"rendered":"http:\/\/172.23.1.43\/?p=147"},"modified":"2022-06-07T22:26:14","modified_gmt":"2022-06-07T22:26:14","slug":"how-to-deploy-office-admx-ws1","status":"publish","type":"post","link":"https:\/\/blog.n-dol.org\/2019\/02\/28\/how-to-deploy-office-admx-ws1\/","title":{"rendered":"ADMX Backed – The Office Case"},"content":{"rendered":"\n

This case come from one of my customer, they followed the Chrome example available at code.vmware.com<\/a>, but didn’t seems to work correctly for the Office ADMX available from Microsoft, as the profile said “Install Failed”.<\/p>\n\n\n\n

Step 1 – Reproduce<\/h1>\n\n\n\n

Created a custom XML in the console in this format :<\/p>\n\n\n\n

<Add>\n <CmdID>2<\/CmdID>\n <Item>\n  <Target>\n   <LocURI>.\/Device\/Vendor\/MSFT\/Policy\/ConfigOperations\/ADMXInstall\/Office16\/Policy\/Version1<\/LocURI>\n  <\/Target>\n  <Data>{AMDX DATA HERE converted from <value> to <value> }<\/Data>\n <\/Item>\n<\/Add><\/code><\/pre>\n\n\n\n\n\n\n\n
Deploying the profile gives the following SyncML response from the device :<\/p>\n\n\n\n
<Status>\n <CmdID>3<\/CmdID>\n <MsgRef>3<\/MsgRef>\n <CmdRef>2<\/CmdRef>\n <Cmd>Add<\/Cmd>\n <Data>425<\/Data>\n<\/Status><\/code><\/pre>\n\n\n\n
According to the SyncML Protocol, 425<\/strong> mean ‘access denied<\/em><\/strong>‘.<\/p>\n\n\n\n
Discovered that later but you have also an Windows Event ID 850 in Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\/Admin <\/strong>which gives the information required…<\/p>\n\n\n\n
\"ADMX-Backed-OfficeADX-Windows-Event-Error\"<\/figure>\n\n\n\n
Step 2 – Back to basics<\/h1>\n\n\n\n
I decided to try another ADMX but as I wanted to rule out any issue with 3rd party ADMX, I’ve used my own.<\/p>\n\n\n\n
Deployed using the same profile as Office, worked as the SyncML response is 200, checked the registry at HKLM\\SOFTWARE\\MICROSOFT\\PolicyManager\\AdmxInstalled<\/b><\/p>\n\n\n\n
\"ADMX-Backed-ADMXTesting-Registry\"<\/figure><\/div>\n\n\n\n
We can see the ADMX install with the right settings.<\/p>\n\n\n\n
Step 3 – RTFM<\/h1>\n\n\n\n
I started to read docs.microsoft.com, I come across this documentation, Win32 and Desktop Bridge app policy configuration<\/a>.<\/p>\n\n\n\n
In the overview, it describe how the ADMX are imported and what are the check against it, and at one point, it says the following :<\/p>\n\n\n\n
the ingested policies are not allowed to write to locations within the System<\/strong>, Software\\Microsoft<\/strong>, and Software\\Policies\\Microsoft<\/strong> keys, except for the following locations:<\/p>