Manage Windows 11 Group Policies Using GPMC

Managing Windows 11 devices in an enterprise environment requires centralized configuration, security enforcement, and administrative control. IT administrators achieve this using the Group Policy Management Console (GPMC) within an Active Directory Domain Services (AD DS) infrastructure. This guide covers the essential steps for configuring, deploying, and managing Windows 11 group policies using GPMC, from updating administrative templates to applying and verifying policy settings on client machines.

1. Update the Central Store with Windows 11 ADMX Templates

To manage settings specific to Windows 11—such as the customized Start menu, Taskbar alignments, Widgets, and enhanced security controls—you must install the latest Administrative Templates (.admx and .adml files).

1. Download the latest Administrative Templates (.admx) for Windows 11 from the official Microsoft Download Center.
2. Run the installer on a management workstation to extract the files (typically located in C:\Program Files (x86)\Microsoft Group Policy\).
3. Copy the .admx files and corresponding language folders (such as en-US containing .adml files) to your domain’s Central Store located at: \\<Your-Domain>\sysvol\<Your-Domain>\policies\PolicyDefinitions

Once populated, GPMC automatically references these templates to display all new Windows 11 policy options.

2. Access the Group Policy Management Console

Administrators can launch GPMC from a Windows Server domain controller or from a Windows 11 management workstation with Remote Server Administration Tools (RSAT) installed:

• Press Win + R, type gpmc.msc, and press Enter.

3. Create and Configure a New GPO

To apply baseline configurations or custom policies to Windows 11 endpoints:

1. In the console tree, expand your forest and domain.
2. Right-click the target Organizational Unit (OU) containing your Windows 11 computer or user accounts.
3. Select Create a GPO in this domain, and Link it here…
4. Enter a descriptive name (e.g., Windows 11 - Baseline Security Policy) and click OK.
5. Right-click the newly created GPO and select Edit to open the Group Policy Management Editor.

4. Configure Windows 11 Specific Policies

Navigate through the editor hierarchy to customize user and computer configurations:

• Start Menu and Taskbar: Navigate to Computer Configuration or User Configuration > Administrative Templates > Start Menu and Taskbar to configure taskbar alignment, pin default applications, and remove unwanted default icons.
• Windows Security and BitLocker: Navigate to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption to mandate hardware-level encryption with TPM 2.0.
• Windows Update for Business: Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update to define update rings, deferral periods, and active hours.
• Widgets and Chat: Navigate to Computer Configuration > Administrative Templates > Windows Components > Widgets to disable consumer widgets on managed corporate devices.

5. Target Windows 11 Devices Using WMI Filtering

If an OU contains a mixed environment of Windows 10 and Windows 11 devices, administrators can use WMI filters to apply policies exclusively to Windows 11 systems:

1. In GPMC, right-click WMI Filters and select New.
2. Name the filter (e.g., Windows 11 Clients Only).
3. Add the following WMI query: SELECT * FROM Win32_OperatingSystem WHERE Version LIKE "10.0.22%" AND ProductType = "1" (Note: Build numbers starting with 22000 and higher identify Windows 11 versions).
4. Save the filter, return to your Windows 11 GPO, and select the newly created filter under the WMI Filtering section at the bottom of the Scope tab.

6. Enforce and Verify Policy Application

After configuring and linking the GPO:

1. On a client Windows 11 machine, open Command Prompt or PowerShell as an administrator.
2. Run gpupdate /force to retrieve the latest policies immediately from the domain controller.
3. Run gpresult /r to view the list of applied GPOs under both the computer and user contexts.
4. For a detailed diagnostic report, generate an HTML report using: gpresult /h C:\GPReport.html Open the file in a browser to confirm that the specific Windows 11 settings are correctly applied without conflicts.