Home / server / Questions / 974096
Accepted
Hawke
Asked: 2019-07-06 05:12:39 +0800 CST

Cannot replace adml file on windows server 2016

  • 772

I am trying to follow the CIS guidelines and need a group policy under

Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction Rules.

I don't even have a folder called 'Windows Defender Antivirus' just 'Windows Defender'.

Apparently this is included in the 1803 Release Admin Templates called WindowsDefender.adml.

I have added a few adml/admx files with no issues, but I assume I need to replace the old WindowsDefender.adml. Unfortunately I keep getting a 'permission denied error'. I tried to change the permissions, but I get the error 'cannot enumerate permissions'.

My central store is 

C:\Windows\SYSVOL\sysvol\domain.local\Policies\PolicyDefinitions

I have tired to do this both from the DC and on my endpoint. I can add new templates, just not replace any old ones.

group-policy

1 Answers

  1. Best Answer

    I used psexec on my DC and opened cmd.exe as system, this allowed me to replace all of my adml and admx files I was having issues with.

    • 0