How's DEM Comp. Env. settings working for everyone?

[pbastiaans]

I am having mixed results using DEM 2006

I did figure out that:

Permissions:

• Domain Computers needs to be added with read permissions to the config share
• Domain Computers needs write to the logging share*
  • * currently I write to local VM as I have not figured away to make logs unique for each session

It appears that GPOs aren't being applied 'normally'. For example, when enabling a GPO that disables it appears the settings are flipped, a 1 instead of a 0. Acrobat bUpdater is my example.

It appears that even when disabling the ADMX in Computer Environments(CE) the GPO continues to be applied. Or if you change the setting, i.e., disabling instead of enabling, it does not honor the change. The workaround I found is that the configuration needs to be deleted and recreated.

Please reply with your experience. IMHO opinion this feature is game changing!

[DEMdev]

Hi @pbastiaans,

I couldn't find a "quote" button in the new system, so let me use italic instead 🙂

• Domain Computers needs to be added with read permissions to the config share
• Domain Computers needs write to the logging share*

Correct. For computer environment settings, share and NTFS permissions should be configured appropriately so that the Domain Computers group (or some other security principal that covers all relevant computer accounts for your particular scenario) has the correct access to the configuration share and to the profile archives share (for logging, typically.)

• * currently I write to local VM as I have not figured away to make logs unique for each session

You can just include %USERNAME% or %COMPUTERNAME% (which is effectively the same here, as this runs in the computer context) somewhere in the log file name.

It appears that GPOs aren't being applied 'normally'. For example, when enabling a GPO that disables it appears the settings are flipped, a 1 instead of a 0. Acrobat bUpdater is my example.

Can you provide the ADMX-based settings config file you're testing with and the ADMX/ADML files it's based on so we can take a look? And do DEM's ADMX-based computer settings act differently than "normal" GPO?

It appears that even when disabling the ADMX in Computer Environments(CE) the GPO continues to be applied. Or if you change the setting, i.e., disabling instead of enabling, it does not honor the change. The workaround I found is that the configuration needs to be deleted and recreated.

When computer environment settings are processed, disabled config files are ignored. Settings that were applied at boot will be reverted at shutdown, and the same happens during a refresh (i.e. "old" settings are reverted before "new" ones are applied.)

How are you testing this, and what do you see in the log?

[pbastiaans]

Thank you.

Can you provide the ADMX-based settings config file you're testing with and the ADMX/ADML files it's based on so we can take a look? And do DEM's ADMX-based computer settings act differently than "normal" GPO?

The templates can be found here:  ftp://ftp.adobe.com/pub/adobe/acrobat/win/AcrobatDC/misc/

The behavior expected is that when setting "Disable Updates" to "Enable" bUpdater key gets set to 0 as I have seen on physical machines. UPDATE: This may be due to 'ghost' admx configs are still in play.

When computer environment settings are processed, disabled config files are ignored. Settings that were applied at boot will be reverted at shutdown, and the same happens during a refresh (i.e. "old" settings are reverted before "new" ones are applied.)

How are you testing this, and what do you see in the log?

To your first statement, agreed, the expectation is that disabled is ignored. I understand the default behavior is to revert on shutdown, there is a reg key to control this, however, the default should be revert.

I create the CE Admx, log in. In the case of fail, I see in the logs the that the old config file name is there. UPDATE: I am wondering if this is due to DEM shares being in a DFS cluster, replication issue.

[DEMdev]

Hi @pbastiaans,

UPDATE: This may be due to 'ghost' admx configs are still in play.

ADMX-based settings won't overwrite any registry settings that are already there, so if GPO-based settings are already/still in the registry, DEM won't touch them.

[pbastiaans]

In the end adding 'Domain Computer' permissions was the fix.

I did need to redo the ADMX configs (possibly the original cofigs did not receive the permissions?)

For the logs, I used a generic filename and placed it in C:\ProgramData\yadayada for the current session. At this time, I am not too concerned about logs after session is disconnected.

The Computer Environment in DEM is an awesome feature.