1
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�26.�System and Account Policies</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.4.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part�III.�Advanced Configuration"><link rel="prev" href="AdvancedNetworkManagement.html" title="Chapter�25.�Advanced Network Management"><link rel="next" href="ProfileMgmt.html" title="Chapter�27.�Desktop Profile Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�26.�System and Account Policies</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Advanced Configuration</th><td width="20%" align="right">�<a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter�26.�System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="PolicyMgmt.html#id2658804">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2658910">Creating and Managing System Policies</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2659098">Windows 9x/ME Policies</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2659235">Windows NT4-Style Policy Files</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2659457">MS Windows 200x/XP Professional Policies</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id2659906">Managing Account/User Policies</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2660133">Management Tools</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2660146">Samba Editreg Toolset</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2660228">Windows NT4/200x</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2660268">Samba PDC</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id2660333">System Startup and Logon Processing Overview</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2660490">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2660502">Policy Does Not Work</a></span></dt></dl></dd></dl></div><p>
2
<a class="indexterm" name="id2658790"></a>
1
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�26.�System and Account Policies</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="The Official Samba 3.4.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part�III.�Advanced Configuration"><link rel="prev" href="AdvancedNetworkManagement.html" title="Chapter�25.�Advanced Network Management"><link rel="next" href="ProfileMgmt.html" title="Chapter�27.�Desktop Profile Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�26.�System and Account Policies</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Advanced Configuration</th><td width="20%" align="right">�<a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter�26.�System and Account Policies"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter�26.�System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="PolicyMgmt.html#id2664856">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2664962">Creating and Managing System Policies</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2665151">Windows 9x/ME Policies</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2665288">Windows NT4-Style Policy Files</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2665509">MS Windows 200x/XP Professional Policies</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id2665958">Managing Account/User Policies</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2666185">Management Tools</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2666198">Samba Editreg Toolset</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2666280">Windows NT4/200x</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2666320">Samba PDC</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id2666385">System Startup and Logon Processing Overview</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2666542">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2666554">Policy Does Not Work</a></span></dt></dl></dd></dl></div><p>
2
<a class="indexterm" name="id2664842"></a>
3
3
This chapter summarizes the current state of knowledge derived from personal
4
4
practice and knowledge from Samba mailing list subscribers. Before reproduction
5
5
of posted information, every effort has been made to validate the information given.
6
6
Where additional information was uncovered through this validation, it is provided
8
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2658804"></a>Features and Benefits</h2></div></div></div><p>
9
<a class="indexterm" name="id2658812"></a>
10
<a class="indexterm" name="id2658819"></a>
11
<a class="indexterm" name="id2658826"></a>
8
</p><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2664856"></a>Features and Benefits</h2></div></div></div><p>
9
<a class="indexterm" name="id2664864"></a>
10
<a class="indexterm" name="id2664871"></a>
11
<a class="indexterm" name="id2664878"></a>
12
12
When MS Windows NT 3.5 was introduced, the hot new topic was the ability to implement
13
13
Group Policies for users and groups. Then along came MS Windows NT4 and a few sites
14
started to adopt this capability. How do we know that? By the number of “<span class="quote">boo-boos</span>”
14
started to adopt this capability. How do we know that? By the number of <span class="quote">“<span class="quote">boo-boos</span>”</span>
15
15
(or mistakes) administrators made and then requested help to resolve.
17
<a class="indexterm" name="id2658844"></a>
18
<a class="indexterm" name="id2658851"></a>
19
<a class="indexterm" name="id2658861"></a>
20
<a class="indexterm" name="id2658867"></a>
21
<a class="indexterm" name="id2658874"></a>
17
<a class="indexterm" name="id2664897"></a>
18
<a class="indexterm" name="id2664904"></a>
19
<a class="indexterm" name="id2664913"></a>
20
<a class="indexterm" name="id2664920"></a>
21
<a class="indexterm" name="id2664926"></a>
22
22
By the time that MS Windows 2000 and Active Directory was released, administrators
23
23
got the message: Group Policies are a good thing! They can help reduce administrative
24
24
costs and actually make happier users. But adoption of the true
27
27
mailing list back in 2000 and 2001 when there were few postings regarding GPOs and
28
28
how to replicate them in a Samba environment.
30
<a class="indexterm" name="id2658896"></a>
30
<a class="indexterm" name="id2664948"></a>
31
31
Judging by the traffic volume since mid 2002, GPOs have become a standard part of
32
32
the deployment in many sites. This chapter reviews techniques and methods that can
33
33
be used to exploit opportunities for automation of control over user desktops and
34
34
network client workstations.
35
</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2658910"></a>Creating and Managing System Policies</h2></div></div></div><p>
36
<a class="indexterm" name="id2658918"></a>
37
<a class="indexterm" name="id2658925"></a>
38
<a class="indexterm" name="id2658932"></a>
39
<a class="indexterm" name="id2658938"></a>
35
</p></div><div class="sect1" title="Creating and Managing System Policies"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2664962"></a>Creating and Managing System Policies</h2></div></div></div><p>
36
<a class="indexterm" name="id2664970"></a>
37
<a class="indexterm" name="id2664977"></a>
38
<a class="indexterm" name="id2664984"></a>
39
<a class="indexterm" name="id2664990"></a>
40
40
Under MS Windows platforms, particularly those following the release of MS Windows
41
41
NT4 and MS Windows 95, it is possible to create a type of file that would be placed
42
42
in the NETLOGON share of a domain controller. As the client logs onto the network,
67
67
complex tools and methods. To Microsoft's credit, the MMC does appear to
68
68
be a step forward, but improved functionality comes at a great price.
70
<a class="indexterm" name="id2659045"></a>
71
<a class="indexterm" name="id2659052"></a>
72
<a class="indexterm" name="id2659059"></a>
73
<a class="indexterm" name="id2659066"></a>
70
<a class="indexterm" name="id2665097"></a>
71
<a class="indexterm" name="id2665104"></a>
72
<a class="indexterm" name="id2665111"></a>
73
<a class="indexterm" name="id2665118"></a>
74
74
Before embarking on the configuration of network and system policies, it is highly
75
75
advisable to read the documentation available from Microsoft's Web site regarding
76
76
<a class="ulink" href="http://www.microsoft.com/ntserver/techresources/management/prof_policies.asp" target="_top">
77
77
Implementing Profiles and Policies in Windows NT 4.0</a>.
78
78
There are a large number of documents in addition to this old one that should also
79
be read and understood. Try searching on the Microsoft Web site for “<span class="quote">Group Policies</span>”.
79
be read and understood. Try searching on the Microsoft Web site for <span class="quote">“<span class="quote">Group Policies</span>”</span>.
81
81
What follows is a brief discussion with some helpful notes. The information provided
82
82
here is incomplete you are warned.
83
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2659098"></a>Windows 9x/ME Policies</h3></div></div></div><p>
84
<a class="indexterm" name="id2659106"></a>
85
<a class="indexterm" name="id2659113"></a>
83
</p><div class="sect2" title="Windows 9x/ME Policies"><div class="titlepage"><div><div><h3 class="title"><a name="id2665151"></a>Windows 9x/ME Policies</h3></div></div></div><p>
84
<a class="indexterm" name="id2665159"></a>
85
<a class="indexterm" name="id2665165"></a>
86
86
You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/Me.
87
87
It can be found on the original full-product Windows 98 installation CD-ROM under
88
88
<code class="filename">tools\reskit\netadmin\poledit</code>. Install this using the
89
89
Add/Remove Programs facility, and then click on <span class="guiicon">Have Disk</span>.
91
<a class="indexterm" name="id2659140"></a>
92
<a class="indexterm" name="id2659147"></a>
91
<a class="indexterm" name="id2665192"></a>
92
<a class="indexterm" name="id2665199"></a>
93
93
Use the Group Policy Editor to create a policy file that specifies the location of
94
94
user profiles and/or <code class="filename">My Documents</code>, and so on. Then save these
95
95
settings in a file called <code class="filename">Config.POL</code> that needs to be placed in the
100
100
Further details are covered in the Windows 98 Resource Kit documentation.
102
<a class="indexterm" name="id2659186"></a>
102
<a class="indexterm" name="id2665238"></a>
103
103
If you do not take the correct steps, then every so often Windows 9x/Me will check the
104
104
integrity of the registry and restore its settings from the backup
105
105
copy of the registry it stores on each Windows 9x/Me machine. So, you will
106
106
occasionally notice things changing back to the original settings.
108
<a class="indexterm" name="id2659201"></a>
109
<a class="indexterm" name="id2659208"></a>
108
<a class="indexterm" name="id2665253"></a>
109
<a class="indexterm" name="id2665260"></a>
110
110
Install the Group Policy handler for Windows 9x/Me to pick up Group Policies. Look on the
111
111
Windows 98 CD-ROM in <code class="filename">\tools\reskit\netadmin\poledit</code>.
112
112
Install Group Policies on a Windows 9x/Me client by double-clicking on
113
113
<code class="filename">grouppol.inf</code>. Log off and on again a couple of times and see
114
114
if Windows 98 picks up Group Policies. Unfortunately, this needs to be done on every
115
115
Windows 9x/Me machine that uses Group Policies.
116
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2659235"></a>Windows NT4-Style Policy Files</h3></div></div></div><p>
117
<a class="indexterm" name="id2659244"></a>
118
<a class="indexterm" name="id2659250"></a>
119
<a class="indexterm" name="id2659257"></a>
120
<a class="indexterm" name="id2659264"></a>
116
</p></div><div class="sect2" title="Windows NT4-Style Policy Files"><div class="titlepage"><div><div><h3 class="title"><a name="id2665288"></a>Windows NT4-Style Policy Files</h3></div></div></div><p>
117
<a class="indexterm" name="id2665296"></a>
118
<a class="indexterm" name="id2665303"></a>
119
<a class="indexterm" name="id2665309"></a>
120
<a class="indexterm" name="id2665316"></a>
121
121
To create or edit <code class="filename">ntconfig.pol</code>, you must use the NT Server
122
122
Policy Editor, <code class="literal">poledit.exe</code>, which is included with NT4 Server
123
123
but not with NT workstation. There is a Policy Editor on an NT4
126
126
workstation/server, it will not work with NT clients. However, the files from
127
127
the NT Server will run happily enough on an NT4 workstation.
129
<a class="indexterm" name="id2659294"></a>
130
<a class="indexterm" name="id2659301"></a>
131
<a class="indexterm" name="id2659308"></a>
132
<a class="indexterm" name="id2659314"></a>
129
<a class="indexterm" name="id2665346"></a>
130
<a class="indexterm" name="id2665353"></a>
131
<a class="indexterm" name="id2665360"></a>
132
<a class="indexterm" name="id2665367"></a>
133
133
You need <code class="filename">poledit.exe</code>, <code class="filename">common.adm</code>, and <code class="filename">winnt.adm</code>.
134
134
It is convenient to put the two <code class="filename">*.adm</code> files in the <code class="filename">c:\winnt\inf</code>
135
135
directory, which is where the binary will look for them unless told otherwise. This
136
directory is normally “<span class="quote">hidden.</span>”
136
directory is normally <span class="quote">“<span class="quote">hidden.</span>”</span>
138
<a class="indexterm" name="id2659360"></a>
139
<a class="indexterm" name="id2659367"></a>
140
<a class="indexterm" name="id2659374"></a>
141
<a class="indexterm" name="id2659381"></a>
138
<a class="indexterm" name="id2665413"></a>
139
<a class="indexterm" name="id2665420"></a>
140
<a class="indexterm" name="id2665426"></a>
141
<a class="indexterm" name="id2665433"></a>
142
142
The Windows NT Policy Editor is also included with the Service Pack 3 (and
143
143
later) for Windows NT 4.0. Extract the files using <code class="literal">servicepackname /x</code>
144
144
that's <code class="literal">Nt4sp6ai.exe /x</code> for Service Pack 6a. The Policy Editor,
146
146
be extracted as well. It is also possible to download the policy template
147
147
files for Office97 and get a copy of the Policy Editor. Another possible
148
148
location is with the Zero Administration Kit available for download from Microsoft.
149
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2659418"></a>Registry Spoiling</h4></div></div></div><p>
150
<a class="indexterm" name="id2659425"></a>
151
<a class="indexterm" name="id2659432"></a>
149
</p><div class="sect3" title="Registry Spoiling"><div class="titlepage"><div><div><h4 class="title"><a name="id2665470"></a>Registry Spoiling</h4></div></div></div><p>
150
<a class="indexterm" name="id2665478"></a>
151
<a class="indexterm" name="id2665484"></a>
152
152
With NT4-style registry-based policy changes, a large number of settings are not
153
153
automatically reversed as the user logs off. The settings that were in the
154
154
<code class="filename">NTConfig.POL</code> file were applied to the client machine registry and apply to the
155
155
hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known
156
156
as tattooing. It can have serious consequences downstream, and the administrator must
157
157
be extremely careful not to lock out the ability to manage the machine at a later date.
158
</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2659457"></a>MS Windows 200x/XP Professional Policies</h3></div></div></div><p>
159
<a class="indexterm" name="id2659465"></a>
158
</p></div></div><div class="sect2" title="MS Windows 200x/XP Professional Policies"><div class="titlepage"><div><div><h3 class="title"><a name="id2665509"></a>MS Windows 200x/XP Professional Policies</h3></div></div></div><p>
159
<a class="indexterm" name="id2665517"></a>
160
160
Windows NT4 system policies allow the setting of registry parameters specific to
161
161
users, groups, and computers (client workstations) that are members of the NT4-style
162
162
domain. Such policy files will work with MS Windows 200x/XP clients also.
175
175
feature is the ability to make available particular software Windows applications to particular
176
176
users and/or groups.
178
<a class="indexterm" name="id2659523"></a>
179
<a class="indexterm" name="id2659530"></a>
180
<a class="indexterm" name="id2659537"></a>
178
<a class="indexterm" name="id2665575"></a>
179
<a class="indexterm" name="id2665582"></a>
180
<a class="indexterm" name="id2665589"></a>
181
181
Remember, NT4 policy files are named <code class="filename">NTConfig.POL</code> and are stored in the root
182
182
of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username and password
183
183
and selects the domain name to which the logon will attempt to take place. During the logon process,
184
184
the client machine reads the <code class="filename">NTConfig.POL</code> file from the NETLOGON share on
185
185
the authenticating server and modifies the local registry values according to the settings in this file.
187
<a class="indexterm" name="id2659566"></a>
188
<a class="indexterm" name="id2659573"></a>
189
<a class="indexterm" name="id2659580"></a>
190
<a class="indexterm" name="id2659587"></a>
191
<a class="indexterm" name="id2659593"></a>
192
<a class="indexterm" name="id2659600"></a>
193
<a class="indexterm" name="id2659610"></a>
194
<a class="indexterm" name="id2659620"></a>
187
<a class="indexterm" name="id2665619"></a>
188
<a class="indexterm" name="id2665625"></a>
189
<a class="indexterm" name="id2665632"></a>
190
<a class="indexterm" name="id2665639"></a>
191
<a class="indexterm" name="id2665646"></a>
192
<a class="indexterm" name="id2665652"></a>
193
<a class="indexterm" name="id2665662"></a>
194
<a class="indexterm" name="id2665672"></a>
195
195
Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of
196
196
a Windows 200x policy file is stored in the Active Directory itself and the other part is stored
197
197
in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active
207
207
to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows
208
208
the administrator to also set filters over the policy settings. No such equivalent capability
209
209
exists with NT4-style policy files.
210
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2659660"></a>Administration of Windows 200x/XP Policies</h4></div></div></div><p>
211
<a class="indexterm" name="id2659669"></a>
212
<a class="indexterm" name="id2659675"></a>
213
<a class="indexterm" name="id2659682"></a>
214
<a class="indexterm" name="id2659689"></a>
215
<a class="indexterm" name="id2659696"></a>
210
</p><div class="sect3" title="Administration of Windows 200x/XP Policies"><div class="titlepage"><div><div><h4 class="title"><a name="id2665713"></a>Administration of Windows 200x/XP Policies</h4></div></div></div><p>
211
<a class="indexterm" name="id2665721"></a>
212
<a class="indexterm" name="id2665727"></a>
213
<a class="indexterm" name="id2665734"></a>
214
<a class="indexterm" name="id2665741"></a>
215
<a class="indexterm" name="id2665748"></a>
216
216
Instead of using the tool called <span class="application">the System Policy Editor</span>, commonly called Poledit (from the
217
217
executable name <code class="literal">poledit.exe</code>), <acronym class="acronym">GPOs</acronym> are created and managed using a
218
<span class="application">Microsoft Management Console</span> <acronym class="acronym">(MMC)</acronym> snap-in as follows:</p><div class="procedure"><ol type="1"><li><p>
218
<span class="application">Microsoft Management Console</span> <acronym class="acronym">(MMC)</acronym> snap-in as follows:</p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
219
219
Go to the Windows 200x/XP menu <span class="guimenu">Start->Programs->Administrative Tools</span>
220
220
and select the MMC snap-in called <span class="guimenuitem">Active Directory Users and Computers</span>
222
<a class="indexterm" name="id2659760"></a>
221
</p></li><li class="step" title="Step 2"><p>
222
<a class="indexterm" name="id2665812"></a>
223
223
Select the domain or organizational unit (OU) that you wish to manage, then right-click
224
224
to open the context menu for that object, and select the <span class="guibutton">Properties</span>.
225
</p></li><li class="step" title="Step 3"><p>
226
226
Left-click on the <span class="guilabel">Group Policy</span> tab, then
227
227
left-click on the New tab. Type a name
228
228
for the new policy you will create.
229
</p></li><li class="step" title="Step 4"><p>
230
230
Left-click on the <span class="guilabel">Edit</span> tab to commence the steps needed to create the GPO.
231
231
</p></li></ol></div><p>
232
232
All policy configuration options are controlled through the use of policy administrative
236
236
well beyond the scope of this documentation to explain how to program .adm files; for that,
237
237
refer to the Microsoft Windows Resource Kit for your particular
238
238
version of MS Windows.
239
</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
240
<a class="indexterm" name="id2659825"></a>
241
<a class="indexterm" name="id2659832"></a>
242
<a class="indexterm" name="id2659839"></a>
239
</p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
240
<a class="indexterm" name="id2665878"></a>
241
<a class="indexterm" name="id2665884"></a>
242
<a class="indexterm" name="id2665891"></a>
243
243
The MS Windows 2000 Resource Kit contains a tool called <code class="literal">gpolmig.exe</code>. This tool can be used
244
244
to migrate an NT4 <code class="filename">NTConfig.POL</code> file into a Windows 200x style GPO. Be VERY careful how you
245
245
use this powerful tool. Please refer to the resource kit manuals for specific usage information.
246
</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2659866"></a>Custom System Policy Templates</h4></div></div></div><p>
246
</p></div></div><div class="sect3" title="Custom System Policy Templates"><div class="titlepage"><div><div><h4 class="title"><a name="id2665918"></a>Custom System Policy Templates</h4></div></div></div><p>
247
247
Over the past year, there has been a bit of talk regarding the creation of customized
248
248
templates for the Windows Sytem Policy Editor. A recent announcement on the Samba mailing
249
249
list is worthy of mention.
257
257
For further information please see the <a class="ulink" href="http://www.pcc-services.com/custom_poledit.html" target="_top">Petersen</a> Computer Consulting web site. There is
258
258
a download link for the template file.
259
</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2659906"></a>Managing Account/User Policies</h2></div></div></div><p>
260
<a class="indexterm" name="id2659914"></a>
261
<a class="indexterm" name="id2659921"></a>
262
<a class="indexterm" name="id2659928"></a>
259
</p></div></div></div><div class="sect1" title="Managing Account/User Policies"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2665958"></a>Managing Account/User Policies</h2></div></div></div><p>
260
<a class="indexterm" name="id2665966"></a>
261
<a class="indexterm" name="id2665973"></a>
262
<a class="indexterm" name="id2665980"></a>
263
263
Policies can define a specific user's settings or the settings for a group of users. The resulting
264
264
policy file contains the registry settings for all users, groups, and computers that will be using
265
265
the policy file. Separate policy files for each user, group, or computer are not necessary.
267
<a class="indexterm" name="id2659943"></a>
267
<a class="indexterm" name="id2665995"></a>
268
268
If you create a policy that will be automatically downloaded from validating domain controllers,
269
269
you should name the file <code class="filename">NTConfig.POL</code>. As system administrator, you have the option of renaming the
270
270
policy file and, by modifying the Windows NT-based workstation, directing the computer to update
272
272
the System Policy Editor. This can even be a local path such that each machine has its own policy file,
273
273
but if a change is necessary to all machines, it must be made individually to each workstation.
275
<a class="indexterm" name="id2659969"></a>
276
<a class="indexterm" name="id2659976"></a>
275
<a class="indexterm" name="id2666021"></a>
276
<a class="indexterm" name="id2666028"></a>
277
277
When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on
278
278
the authenticating domain controller for the presence of the <code class="filename">NTConfig.POL</code> file. If one exists, it is
279
279
downloaded, parsed, and then applied to the user's part of the registry.
281
<a class="indexterm" name="id2659997"></a>
282
<a class="indexterm" name="id2660003"></a>
283
<a class="indexterm" name="id2660010"></a>
284
<a class="indexterm" name="id2660017"></a>
281
<a class="indexterm" name="id2666049"></a>
282
<a class="indexterm" name="id2666056"></a>
283
<a class="indexterm" name="id2666062"></a>
284
<a class="indexterm" name="id2666069"></a>
285
285
MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally
286
286
acquire policy settings through GPOs that are defined and stored in Active Directory
287
287
itself. The key benefit of using AD GPOs is that they impose no registry <span class="emphasis"><em>spoiling</em></span> effect.
288
288
This has considerable advantage compared with the use of <code class="filename">NTConfig.POL</code> (NT4) style policy updates.
290
<a class="indexterm" name="id2660043"></a>
291
<a class="indexterm" name="id2660050"></a>
290
<a class="indexterm" name="id2666095"></a>
291
<a class="indexterm" name="id2666102"></a>
292
292
In addition to user access controls that may be imposed or applied via system and/or group policies
293
293
in a manner that works in conjunction with user profiles, the user management environment under
294
294
MS Windows NT4/200x/XP allows per-domain as well as per-user account restrictions to be applied.
295
295
Common restrictions that are frequently used include:
297
<a class="indexterm" name="id2660066"></a>
298
</p><div class="itemizedlist"><ul type="disc"><li><p>Logon hours</p></li><li><p>Password aging</p></li><li><p>Permitted logon from certain machines only</p></li><li><p>Account type (local or global)</p></li><li><p>User rights</p></li></ul></div><p>
297
<a class="indexterm" name="id2666118"></a>
298
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Logon hours</p></li><li class="listitem"><p>Password aging</p></li><li class="listitem"><p>Permitted logon from certain machines only</p></li><li class="listitem"><p>Account type (local or global)</p></li><li class="listitem"><p>User rights</p></li></ul></div><p>
300
<a class="indexterm" name="id2660103"></a>
301
<a class="indexterm" name="id2660110"></a>
300
<a class="indexterm" name="id2666155"></a>
301
<a class="indexterm" name="id2666162"></a>
302
302
Samba-3.0.20 does not yet implement all account controls that are common to MS Windows NT4/200x/XP.
303
303
While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password
304
304
expiry is functional today. Most of the remaining controls at this time have only stub routines
305
305
that may eventually be completed to provide actual control. Do not be misled by the fact that a
306
306
parameter can be set using the NT4 Domain User Manager or in the <code class="filename">NTConfig.POL</code>.
307
</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2660133"></a>Management Tools</h2></div></div></div><p>
307
</p></div><div class="sect1" title="Management Tools"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2666185"></a>Management Tools</h2></div></div></div><p>
308
308
Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools.
309
309
The following sections describe a few key tools that will help you to create a low-maintenance user
311
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660146"></a>Samba Editreg Toolset</h3></div></div></div><p>
312
<a class="indexterm" name="id2660154"></a>
313
<a class="indexterm" name="id2660160"></a>
314
<a class="indexterm" name="id2660167"></a>
311
</p><div class="sect2" title="Samba Editreg Toolset"><div class="titlepage"><div><div><h3 class="title"><a name="id2666198"></a>Samba Editreg Toolset</h3></div></div></div><p>
312
<a class="indexterm" name="id2666206"></a>
313
<a class="indexterm" name="id2666212"></a>
314
<a class="indexterm" name="id2666219"></a>
315
315
A new tool called <code class="literal">editreg</code> is under development. This tool can be used
316
316
to edit registry files (called <code class="filename">NTUser.DAT</code>) that are stored in user
317
317
and group profiles. <code class="filename">NTConfig.POL</code> files have the same structure as the
320
320
permit the building of new <code class="filename">NTConfig.POL</code> files with extended capabilities. It is proving difficult
321
321
to realize this capability, so do not be surprised if this feature does not materialize. Formal
322
322
capabilities will be announced at the time that this tool is released for production use.
323
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660228"></a>Windows NT4/200x</h3></div></div></div><p>
324
<a class="indexterm" name="id2660236"></a>
325
<a class="indexterm" name="id2660242"></a>
326
<a class="indexterm" name="id2660249"></a>
323
</p></div><div class="sect2" title="Windows NT4/200x"><div class="titlepage"><div><div><h3 class="title"><a name="id2666280"></a>Windows NT4/200x</h3></div></div></div><p>
324
<a class="indexterm" name="id2666288"></a>
325
<a class="indexterm" name="id2666295"></a>
326
<a class="indexterm" name="id2666302"></a>
327
327
The tools that may be used to configure these types of controls from the MS Windows environment are
328
328
the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe).
329
329
Under MS Windows 200x/XP, this is done using the MMC with appropriate
330
“<span class="quote">snap-ins,</span>” the registry editor, and potentially also the NT4 System and Group Policy Editor.
331
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660268"></a>Samba PDC</h3></div></div></div><p>
332
<a class="indexterm" name="id2660276"></a>
333
<a class="indexterm" name="id2660283"></a>
334
<a class="indexterm" name="id2660289"></a>
335
<a class="indexterm" name="id2660296"></a>
330
<span class="quote">“<span class="quote">snap-ins,</span>”</span> the registry editor, and potentially also the NT4 System and Group Policy Editor.
331
</p></div><div class="sect2" title="Samba PDC"><div class="titlepage"><div><div><h3 class="title"><a name="id2666320"></a>Samba PDC</h3></div></div></div><p>
332
<a class="indexterm" name="id2666328"></a>
333
<a class="indexterm" name="id2666335"></a>
334
<a class="indexterm" name="id2666342"></a>
335
<a class="indexterm" name="id2666348"></a>
336
336
With a Samba domain controller, the new tools for managing user account and policy information include:
337
337
<code class="literal">smbpasswd</code>, <code class="literal">pdbedit</code>, <code class="literal">net</code>, and <code class="literal">rpcclient</code>.
338
338
The administrator should read the man pages for these tools and become familiar with their use.
339
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2660333"></a>System Startup and Logon Processing Overview</h2></div></div></div><p>
339
</p></div></div><div class="sect1" title="System Startup and Logon Processing Overview"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2666385"></a>System Startup and Logon Processing Overview</h2></div></div></div><p>
340
340
The following attempts to document the order of processing the system and user policies following a system
341
341
reboot and as part of the user logon:
342
</p><div class="orderedlist"><ol type="1"><li><p>
343
<a class="indexterm" name="id2660354"></a>
344
<a class="indexterm" name="id2660364"></a>
342
</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>
343
<a class="indexterm" name="id2666407"></a>
344
<a class="indexterm" name="id2666416"></a>
345
345
Network starts, then Remote Procedure Call System Service (RPCSS) and multiple universal naming
346
346
convention provider (MUP) start.
348
<a class="indexterm" name="id2660381"></a>
349
<a class="indexterm" name="id2660387"></a>
347
</p></li><li class="listitem"><p>
348
<a class="indexterm" name="id2666433"></a>
349
<a class="indexterm" name="id2666440"></a>
350
350
Where Active Directory is involved, an ordered list of GPOs is downloaded
351
351
and applied. The list may include GPOs that:
352
</p><div class="itemizedlist"><ul type="disc"><li><p>Apply to the location of machines in a directory.</p></li><li><p>Apply only when settings have changed.</p></li><li><p>Depend on configuration of the scope of applicability: local,
352
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Apply to the location of machines in a directory.</p></li><li class="listitem"><p>Apply only when settings have changed.</p></li><li class="listitem"><p>Depend on configuration of the scope of applicability: local,
353
353
site, domain, organizational unit, and so on.</p></li></ul></div><p>
354
354
No desktop user interface is presented until the above have been processed.
355
</p></li><li class="listitem"><p>
356
356
Execution of startup scripts (hidden and synchronous by default).
357
</p></li><li class="listitem"><p>
358
358
A keyboard action to effect start of logon (Ctrl-Alt-Del).
359
</p></li><li class="listitem"><p>
360
360
User credentials are validated, user profile is loaded (depends on policy settings).
361
</p></li><li class="listitem"><p>
362
362
An ordered list of user GPOs is obtained. The list contents depends on what is configured in respect of:
364
</p><div class="itemizedlist"><ul type="disc"><li><p>Is the user a domain member, thus subject to particular policies?</p></li><li><p>Loopback enablement, and the state of the loopback policy (merge or replace).</p></li><li><p>Location of the Active Directory itself.</p></li><li><p>Has the list of GPOs changed? No processing is needed if not changed.</p></li></ul></div><p>
364
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Is the user a domain member, thus subject to particular policies?</p></li><li class="listitem"><p>Loopback enablement, and the state of the loopback policy (merge or replace).</p></li><li class="listitem"><p>Location of the Active Directory itself.</p></li><li class="listitem"><p>Has the list of GPOs changed? No processing is needed if not changed.</p></li></ul></div><p>
365
</p></li><li class="listitem"><p>
366
366
User policies are applied from Active Directory. Note: There are several types.
367
</p></li><li class="listitem"><p>
368
368
Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on GPOs
369
369
(hidden and executed synchronously). NT4-style logon scripts are then run in a normal
371
</p></li><li class="listitem"><p>
372
372
The user interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4
373
373
domain), machine (system) policies are applied at startup; user policies are applied at logon.
374
</p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2660490"></a>Common Errors</h2></div></div></div><p>
374
</p></li></ol></div></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2666542"></a>Common Errors</h2></div></div></div><p>
375
375
Policy-related problems can be quite difficult to diagnose and even more difficult to rectify. The following
376
376
collection demonstrates only basic issues.
377
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660502"></a>Policy Does Not Work</h3></div></div></div><p>
378
“<span class="quote">We have created the <code class="filename">Config.POL</code> file and put it in the <span class="emphasis"><em>NETLOGON</em></span> share.
377
</p><div class="sect2" title="Policy Does Not Work"><div class="titlepage"><div><div><h3 class="title"><a name="id2666554"></a>Policy Does Not Work</h3></div></div></div><p>
378
<span class="quote">“<span class="quote">We have created the <code class="filename">Config.POL</code> file and put it in the <span class="emphasis"><em>NETLOGON</em></span> share.
379
379
It has made no difference to our Win XP Pro machines, they just do not see it. It worked fine with Win 98 but does not
380
work any longer since we upgraded to Win XP Pro. Any hints?</span>”
380
work any longer since we upgraded to Win XP Pro. Any hints?</span>”</span>
382
382
Policy files are not portable between Windows 9x/Me and MS Windows NT4/200x/XP-based platforms. You need to
383
383
use the NT4 Group Policy Editor to create a file called <code class="filename">NTConfig.POL</code> so it is in the
added
removed
docs/htmldocs/Samba3-HOWTO/PolicyMgmt.html
