That's right; you can create your own Group Policy settings. As you probably suspect, this is done by creating your own ADMX/ADML files. Again, we will get more hands-on with these template files later in the book. However, there are some important topics to discuss beforehand because it is very possible you will never actually create your own ADMX file, but you very well might utilize an Administrative Template setting that has been built upon an ADMX file created by someone else (such as Microsoft), and you need to remember that those settings could be managed, or they could be unmanaged. One purpose for creating your own template files would be to manipulate settings for a particular software application that you are running on your machines. Maybe you need to tweak some of the application's settings for all of your users, and don't want to walk around and perform those changes by hand on all of the computers. Almost all software applications utilize the registry in Windows, so it makes sense that you could use an Administrative Template in order to tweak some of those registry settings. Yes, this is true and can be very helpful, but it is most likely that an application's registry settings do not exist within our four special sections of the registry that are managed. Therefore, remember that if you are going to be creating new template settings, it is most likely that they will not be managed, and that your settings will continue to exist inside the registry of your workstations even after the GPO no longer applies to the machine, perhaps even after the piece of software is uninstalled from that computer.

Your custom Administrative Template settings that fall into the unmanaged category also have the potential to be usurped by users. You may set something via this policy, only to find that a user has used their own keyboard and mouse to counteract your setting and configure it differently.

If the registry keys you are manipulating with your own Admin Template are actually contained within one of those four special sections of the registry, you're in luck! Your homegrown, customized settings would be managed policy settings, and behave just like those settings built into Group Policy by default.

Sometimes Microsoft puts time and effort into creating ADMX/ADML templates that you can then import into Group Policy to plug new settings into the Group Policy Editor. This may be the case for a particular piece of Microsoft technology that can utilize Group Policy settings, but is perhaps a technology that not everyone will deploy in their environments, and so those settings are not part of the out of the box Admin Templates inside Active Directory. We will walk through an example of importing such a template in Chapter 8, Group Policy Maintenance.