Group Policy Setup

Install the Deck ADMX templates and understand policy scope, precedence, and how Deck reads policy

Deck is configured through Group Policy using the ADMX templates shipped with each release. This page covers installing the templates and the rules Deck follows when it reads policy. For the settings themselves, see the Policy Reference.

What you get

Each release publishes two files alongside the MSI:

File	Purpose
`Vediram.admx`	The policy definitions
`en-US\Vediram.adml`	The English-language display strings

Download them from the release CDN:

https://downloads.vediram.com/releases/deck/stable/v1.8.0/

Install the templates

Domain central store (recommended)

Use the central store so every machine that edits the GPO sees the templates, without copying files to each admin workstation:

Copy Vediram.admx to \\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\
Copy en-US\Vediram.adml to \\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-US\

If the PolicyDefinitions folder doesn't exist yet, create it - its presence is what enables the central store.

Single machine (local)

For a standalone machine or a test box, copy the files into the local store:

Vediram.admx → C:\Windows\PolicyDefinitions\
en-US\Vediram.adml → C:\Windows\PolicyDefinitions\en-US\

Local Group Policy (gpedit.msc) is only available on Windows Pro, Enterprise, and Education - not Home.

Where the settings appear

Open Group Policy Management (domain) or gpedit.msc (local) and navigate to:

[Computer Configuration | User Configuration]
  └ Policies (domain) / Administrative Templates
      └ Vediram
          └ Deck
              ├ Features
              ├ Profiles
              ├ Folders
              ├ General
              ├ Management            (Computer Configuration only)
              └ Managed Extensions    (Computer Configuration only)

Machine scope vs. user scope

Each Deck policy is available under Computer Configuration, User Configuration, or both:

Scope	Node	Registry hive
Machine	Computer Configuration	`HKLM\SOFTWARE\Policies\Vediram\Deck`
User	User Configuration	`HKCU\SOFTWARE\Policies\Vediram\Deck`

Most settings can be set in either node. A few are restricted: AutoStart is user-only, while ManagementMode and the Managed Extensions settings are machine-only. The Policy Reference lists the scope for each.

Precedence

When the same setting is configured in both hives, machine (HKLM) wins over user (HKCU). Deck evaluates each policy by reading HKLM first and falling back to HKCU. A setting left Not Configured in both hives means Deck uses its built-in default (and, for user-facing settings such as AutoStart and PollingInterval, lets the user choose).

How Deck applies policy

Deck reads policy from the registry when the Core daemon starts. After changing a GPO, a policy refresh (gpupdate /force) followed by a Deck restart applies the new values. A machine or user reboot/sign-in also picks them up.
Any setting that is configured shows a managed by IT indicator in the Deck UI, and the corresponding control is locked so users cannot override it.
Policy and the client install are independent. You can apply policy before Deck is installed; it takes effect the first time the daemon runs.

Verifying applied policy

Confirm what actually landed on a client by reading the registry directly:

# Machine-scope policies
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Vediram\Deck" -ErrorAction SilentlyContinue

# User-scope policies
Get-ItemProperty "HKCU:\SOFTWARE\Policies\Vediram\Deck" -ErrorAction SilentlyContinue

If a value you set isn't present, the GPO hasn't refreshed or isn't scoped to that machine/user. See Group Policy not applying.

Updates & Uninstall Policy Reference