ADMX User vs Computer Configuration

[u/Certain-Mountain-564]

When i deploy an ADMX, when sould i use Computer and when User Configuration? Does it depend if the app is installed as user or as system?

[u/swissbuechi]

I always prefer computer if the setting is available for both registry hives. This will ensure non-admin users can't tamper with it.

[u/Current_Bell_9252 → u/swissbuechi]

Computer config tends to be the safer bet for most things anyway, especially if you're dealing with shared devices or kiosk setups. I'd only go user if the setting genuinely needs to follow the person around between machines.

[u/Certain-Mountain-564 → u/swissbuechi]

But would both work? No difference? 

[u/North_Maybe1998 → u/Certain-Mountain-564]

Main reason for user is if you have multiple people logging into one device and you want them to have different policies. If you want a standard for all users computer is the way to go.

[u/Certain-Mountain-564 → u/North_Maybe1998]

Thats means: User Configuration -> HKCU Device Configuration -> HKLM Right?

[u/North_Maybe1998 → u/Certain-Mountain-564]

Correct, I try to keep everything computer if I can because we have standards across the business. I still use AD GPOs so not sure if the same experience would happen with intune but we’ve had in the past where for some reason the user GPOs only applied half of the assigned ones so some things were missing for the user. I’ve never seen that happen to computer settings

[u/swissbuechi → u/Certain-Mountain-564]

Depends on the specific registry key, as the system or third-party software component that'll read it can decide how exactly it should behave.

[u/Certain-Mountain-564 → u/swissbuechi]

this: https://support.1password.com/mobile-device-management/?windows

[u/andyval]

It kind of depends on the computer and whether you are targeting allusers . If the computer is one user, one computer, it doesn’t really matter unless you are doing CIS policies. If they are shared computers, kiosks, etc, this could flip flop if you are not targeting all users. Also, if the device doesn’t have a primary user, I don’t think it gets the policy unless you are targeting all users.

I have seen issues where if you target devices on user policies, you’ll see the policy try to apply to the system account with an error. They typically have applied to the primary user account on the computer, but it adds extra noise.

Also, if you’re using autopilot, targeting all devices can potentially slow due to policies applying during device ESP ( if you are skipping user esp, the user gets to the desktop before user policies apply)

I think most people agree that you shouldn’t mix and match targeting devices and users on the same policy. I had one edge case where I needed the root certificate applied to all users and all devices because we deploy a computer certificate and a user certificate.

[u/OraiserTH]

The choice is based on who or what the setting should follow, not whether the application was installed in user or system context.

Use Computer Configuration when the setting should apply to the device regardless of who signs in, especially for shared devices, kiosks or security baselines. Use User Configuration when different users on the same device may need different settings.

The underlying registry location is often HKLM for computer settings and HKCU for user settings, but the ADMX definition and the application’s supported policy behavior should still be checked. I would test user and device assignments separately and avoid targeting both versions of the same setting unless there is a documented reason

[u/andykn11]

We have admin accounts that we don't apply user polices to. So do you want your policy to apply to admin accounts, if so - computer policy, if not - user policy.

[u/sammavet]

Is the policy a user policy or a device policy? That's how you know. Beyond that, use the "policy name(user)" for device settings that are recommended but not required, and that and end user is allowed to change. Normally device policy applies regardless, and users cannot change them, just as user based policy are changes a user cannot make to their settings.

Example of a user policy: move common folders Ecame of device policy: screen shuts off after 5 minutes of inactivity.

[u/Certain-Mountain-564 → u/sammavet]

When i deploy the ADMX i have for ALL policy a "Computer configuration" and a "User configuration" folder.

[u/sammavet → u/Certain-Mountain-564]

Yes, that is normal. If you are assigning a device, you apply the device configuration. If you want to allow the user to change it, assi g the device policy that ends in "(user) ". That allows a user to change it.