{"id":341,"date":"2019-05-22T09:12:35","date_gmt":"2019-05-22T09:12:35","guid":{"rendered":"http:\/\/172.23.1.43\/?p=341"},"modified":"2022-06-07T22:36:16","modified_gmt":"2022-06-07T22:36:16","slug":"deep-dive-admx-ingestion-on-windows-10","status":"publish","type":"post","link":"https:\/\/blog.n-dol.org\/2019\/05\/22\/deep-dive-admx-ingestion-on-windows-10\/","title":{"rendered":"Deep Dive – ADMX Ingestion on Windows 10"},"content":{"rendered":"\n

As I have solved the issue on ingesting the Office16.admx<\/a>, I thought I would review the whole ingestion process to help understand how it works under the hood and how to manage it.<\/p>\n\n\n\n

Since Windows 10 1703, ADMX can be ingested and processed by the MDM layer via the policy CSP with the URI <\/p>\n\n\n\n

.\/Device\/Vendor\/MSFT\/Policy\/ConfigOperations\/ADMXInstall\/<\/code><\/pre>\n\n\n\n
For this article, I will use ADMX files that I have created for each situation. The name of the example application is CamilleApp<\/strong> and published by DebayCorp<\/strong> company.<\/p>\n\n\n\n\n\n\n\n
ADMX Ingestion<\/h1>\n\n\n\n
The ADMXInstall URI<\/h2>\n\n\n\n
The ADMX Install URI has 3 configurable settings:<\/p>\n\n\n\n
...\/ConfigOperation\/ADMXInstall\/{AppName}\/{Area}\/{UniqueID}<\/code><\/pre>\n\n\n\n
AppName:<\/strong><\/span> <\/strong>Name of the Application targeted by this ADMX. Depending what you are targeting it should be unique to the application in case to cater for multiple version of the same application.
Operation supported : Add<\/code>, Get<\/code>, Delete<\/code>
Example: Office 2016 and Office 2013 should be Office2016 and Office2013<\/p>\n\n\n\n
ADMX Area:<\/strong><\/span> <\/strong>There are 2 areas which ADMX ingestion covers; which are Policy and Preference.
Policy<\/strong> is for usual GPO
Preference<\/strong> is for preference GPO
Operation supported : Add<\/code>, Get<\/code>, Delete<\/code><\/p>\n\n\n\n
UniqueID:<\/span><\/strong> This parameter is unique to the ADMX installation, it is only used at the installation. Policy Manager uses it for versioning in case of update, more detail below.
Operation supported : Add<\/code>, Get<\/code><\/p>\n\n\n\n
The ADMX Install URI, follows LocURI format, you should stick to alphanumeric characters (a-z<\/code>, A-Z<\/code>,0-9<\/code>) and may use underscore(_<\/code>), I would advise against any other characters which can be used in URI, as this may be used in some other scenario.<\/p>\n\n\n\n
Limitation<\/h2>\n\n\n\n
Finally, as described in my previous article on Office<\/a>, there are some limitations on the ingestion process. I’ve coded a PS script to validate the ADMX against these limitations.
ADMXValidation Script<\/a><\/p>\n\n\n\n
the ingested policies are not allowed to write to locations within the System<\/strong>, Software\\Microsoft<\/strong>, and Software\\Policies\\Microsoft<\/strong> keys, except for the following locations:<\/p>