Using the GPO Editor

Microsoft defines and releases more than 4000 Group Policy Objects (GPOs) to control Windows 10 Desktop devices. The GPO Editor allows administrators to view and search for GPOs quickly and easily, based on Microsoft's hierarchal groups and sub-groups. It also allows administrators to upload ADMX GPOs (custom for third party applications) that run outside of the Windows 10 operating system.

The GPO Editor validates all Microsoft GPO selections, the values provided for policy options, and the ADMX files. It also validates all custom ADMX GPO settings when the custom file specifies the key, with the exception of free form text.

Note The Following:  

• For more information about Microsoft GPOs, go to the following page: https://technet.microsoft.com/en-us/library/hh147307(v=ws.10).aspx. This page is controlled by a third party and can be removed, moved, or modified at any time without notice. It is provided here only as a courtesy.
• Any GPO configurations created before 9.6.0.0 will be deleted upon upgrading to 9.6.0.0 through the most recently released version as supported by MobileIron. MobileIron recommends administrators save the settings created in before 9.5.0.0 and create a new profile after upgrading to any 9.6.0.0 through the most recently released version as supported by MobileIron.

Adding a Windows 10 GPO

This procedure describes how to add GPOs that will modify the Windows Registry.

Procedure 

1. Go to Policies & Configs > Configurations.
2. Click Add New > Windows > MobileIron (Windows 10 Only) > Windows GPO.
3. Enter the name of the GPO configuration in the Name field.
4. Click the arrow in the Add Description option if you want to add a description.
5. Click Add.
6. Expand the object tree to select a GPO or use the search field to find the GPO you want to add.

If you use the search feature, you can narrow the search scope by selecting the Machine (the default option) or User options. You can switch between these options.

7. Select Enabled to turn on the setting or create a new setting in the Registry.

Some settings simply turn on the setting with no additional configurations. If a setting has a sub-setting, complete the wizard after clicking Enabled.

8. Click Save & Add another to add more GPOs (optional).

Repeat steps 7-9 until you are done adding GPOs.

9. Click Save & Close when you are done adding GPOs.
10. Apply the configuration to a label to deploy the configuration to devices.
a. Select the configuration.
b. Click Actions > Apply to Labels.
c. Select one or more labels.
d. Click Apply.

Core pushes the configuration to devices associated with the applied label(s) after the next sync with Core.

Adding an ADMXGPO

This procedure describes how to add ADMX GPOs to upload custom third party applications. Refer to ADMX file structure for details on creating the required folder structure to zip the .admx files.

Procedure 

1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Windows > MobileIron (Windows 10 Only) > Windows GPO.
4. Enter the name of the GPO configuration in the Name field.
5. Click the arrow in the Add Description option if you want to add a description.
6. Click Add+.
7. Click Import ADMX+ next to the Search field to open the Import ADMX files window.
8. Click Import to locate and add the ADMX file.
9. Click Import again to import your ADMX file.
10. Click Save & Add another to add more GPOs (optional).

Repeat steps 7-10 until you are done adding GPOs.

11. Click Save & Close when you are done adding GPOs.
12. Apply the configuration to a label to deploy the configuration to devices.
a. Select the configuration.
b. Click Actions > Apply to Labels.
c. Select one or more labels.
d. Click Apply.

Core pushes the configuration to devices associated with the applied label(s) after the next sync with Core.

ADMX file structure

Create .admx zip files by zipping the folder containing the .admx file and the locale folders. Do not simply create is by zipping the contents of the folder.

Use the following file structure under the .admx package’s location:

|-- admx

|-- windows

|-- en-US

|-- win_policy_1.adml

|-- win_policy_2.adml

|-- win_policy_1.admx

|-- win_policy_2.admx

|-- google

|-- en-US

|-- google_policy_1.adml

|-- google_policy_2.adml

|-- google_policy_1.admx

|-- google_policy_2.admx

Disabling a GPO setting

This procedure describes how to disable a GPO setting to turn it off, but not to delete it.

NOTE: Some settings, once created, can never be deleted without a full device wipe.

Procedure 

1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Windows > MobileIron (Windows 10 Only) > Windows GPO.
4. Enter the name of the GPO configuration in the Name field.
5. Click Add.
6. Expand the object tree to select a GPO or use the search field to find the GPO you want to disable.

If you use the search feature, you can narrow the search scope by selecting the Machine or User options.

7. Select Disabled to turn off the setting.
8. Click Save & Close.