I'm trying to figure out how to completely disable autorun on a domain for every server and workstation.

Doing some googling has shown that you can add new options to the administrative templates by modifying the system.adm file where all the admin templates are listed.

Currently, the modified system.adm file lives on all the domain controllers. However, I do appear to have problems enforcing this autorun change through a GPO. I've done the usual of creating a GPO, detailing the change. But when I do a gpupdate on all clients or reboot the PC, nothing happens.

Do I need to have the modified system.adm file present on all the clients and servers as well as the DCs? I guess the answer is yes, but not sure on this one.

Unless I've misunderstood , this seems to be pretty straightforward.

How to Disable Autorun

Alex, that's essentially what I'm doing.

Apologies for being cryptic. The trouble with the "All drives" option is that it defines only certain drives.

All drives are identified by a mask, so a: is 1, b: is 2, c: is 4, d: is 8, etc. The all drives option only goes up to a certain value which translates to certain drive letters.

In the system I have, there's a huge SAN which has four different volumes, w:, x:, y: and z:. The all drives parameter doesn't cover this, so if anyone sticks in a bit of malicious autorun.inf files in there, it will run on all SAN clients.

The default options you see are detailed in the system.adm file. But because I need to extend it, I've had to edit the system.adm file to include another option which is then available from the drop down menu in the gp editor.

Of course, all clients on the domain have a standard system.adm file. Question is whether I need my modified system.adm file which contains the extended mask / drive letters copied to all clients.

short answer ... yup

Cheers Danny.

Next question: what's the easiest way through GPO or other to ensure the DC's correct system.adm file is copied across to all domain clients?

Free virtual croissant (as I'm in Paris) for the answer

I would have though a login script... been a while since I played with AD.

I believe microsoft say not to modify the system.adm file , but create a new one with the extra parameters and use that in the GPO via add/remove templates.

Then it should get replicated to everyone via the usual sysvol shares.

Ah , here we go...

Recommendations for managing Group Policy administrative template (.adm) files

I believe microsoft say not to modify the system.adm file , but create a new one with the extra parameters and use that in the GPO via add/remove templates.

Then it should get replicated to everyone via the usual sysvol shares.

Ah , here we go...

Recommendations for managing Group Policy administrative template (.adm) files

Aha, will have a li'l read Ta muchly

Oooh, in case of interest, after some more digging:

Using Administrative Template Files with Registry-Based Group Policy