Administrative Template Storage for Entra Domain Services Joined AVD (multi-session) - group policy object

Question

Administrative Template Storage for Entra Domain Services Joined AVD (multi-session) - group policy object

Luke 95

Hi there,

We are currently testing Group Policy to control user behaviour in our Entra Domain Services joined AVD multi-session environment.

We are using a small management VM to manage Group Policy, and we noticed that the required Administrative Templates are not available by default. Therefore, we need to import the relevant ADMX templates, such as the Microsoft Office ADMX templates.

The question is about the best location to store these templates. There appear to be two options:

Store them locally on the management VM under C:\Windows\PolicyDefinitions

Store them in the SYSVOL Central Store under the domain

Which option is recommended for an Entra Domain Services joined AVD environment?

Thanks.

0 comments

1 answer

Your answer

Answer 1

For an Entra Domain Services–joined Azure Virtual Desktop (multi-session) environment that uses a dedicated management VM for Group Policy administration, the recommended approach is to use a Central Store in SYSVOL rather than only local PolicyDefinitions on the management VM.

Reasoning and recommended setup:

Create and use a Central Store in SYSVOL
- Create the Central Store folder on the Entra Domain Services domain (example path):
  \\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions
- Copy the required ADMX/ADML files (Windows, Office, AVD-related templates, etc.) from a source machine into this PolicyDefinitions folder. The source can be:
  - C:\Windows\PolicyDefinitions on a Windows 10/11 or server admin workstation, or
  - A downloaded template location such as C:\Program Files (x86)\Microsoft Group Policy\<version-specific>\PolicyDefinitions for separately downloaded templates.
- Ensure language-specific ADML files (for example, en-US) are copied into the corresponding subfolder under PolicyDefinitions.
Group Policy tools (GPMC, Group Policy Management Editor) will then automatically use the ADMX templates from this Central Store. The files in the Central Store are replicated to all domain controllers, so any admin VM or management host that connects to the domain uses the same template set.
Why Central Store is preferred over local-only PolicyDefinitions
- A Central Store is the default-checked location for Group Policy tools and ensures a single, consistent set of ADMX/ADML files for all administrators.
- Templates stored locally under C:\Windows\PolicyDefinitions on a single management VM are not shared or replicated. Other admin machines would not see the same templates unless manually kept in sync.
- Using a Central Store avoids conflicts and version mismatches between different admin workstations and simplifies management when multiple admins or management VMs are used.
Versioning and rollback considerations
- When updating templates (for example, new Windows or Office ADMX versions), build a new PolicyDefinitions-<version> folder in SYSVOL, copy the updated templates there, then swap folder names so that the new folder becomes the active PolicyDefinitions.
- Keep the previous PolicyDefinitions-<oldversion> folder as a backup so it is possible to revert if issues arise.
When local PolicyDefinitions is useful
- Local C:\Windows\PolicyDefinitions on the management VM can still be used for testing new or modified ADMX/ADML files before copying them into the Central Store.
- This allows validation of new templates against existing GPOs without impacting production templates in SYSVOL.

In summary: for an Entra Domain Services–joined AVD environment, store the production ADMX/ADML templates in the SYSVOL Central Store and use the management VM’s local PolicyDefinitions only as a staging/testing location.

References: