~zulcss/samba/server-dailies-3.4

<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�26.�System and Account Policies</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.4.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part�III.�Advanced Configuration"><link rel="prev" href="AdvancedNetworkManagement.html" title="Chapter�25.�Advanced Network Management"><link rel="next" href="ProfileMgmt.html" title="Chapter�27.�Desktop Profile Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�26.�System and Account Policies</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Advanced Configuration</th><td width="20%" align="right">�<a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter�26.�System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="PolicyMgmt.html#id2658770">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2658876">Creating and Managing System Policies</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2659065">Windows 9x/ME Policies</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2659202">Windows NT4-Style Policy Files</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2659424">MS Windows 200x/XP Professional Policies</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id2659873">Managing Account/User Policies</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2660100">Management Tools</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2660112">Samba Editreg Toolset</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2660194">Windows NT4/200x</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2660235">Samba PDC</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id2660299">System Startup and Logon Processing Overview</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2660457">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2660469">Policy Does Not Work</a></span></dt></dl></dd></dl></div><p>

This chapter summarizes the current state of knowledge derived from personal

practice and knowledge from Samba mailing list subscribers. Before reproduction

of posted information, every effort has been made to validate the information given.

Where additional information was uncovered through this validation, it is provided

also.

</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2658770"></a>Features and Benefits</h2></div></div></div><p>

When MS Windows NT 3.5 was introduced, the hot new topic was the ability to implement

Group Policies for users and groups. Then along came MS Windows NT4 and a few sites

started to adopt this capability. How do we know that? By the number of “<span class="quote">boo-boos</span>”

(or mistakes) administrators made and then requested help to resolve.

</p><p>

By the time that MS Windows 2000 and Active Directory was released, administrators

got the message: Group Policies are a good thing! They can help reduce administrative

costs and actually make happier users. But adoption of the true

potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users

and machines were picked up on rather slowly. This was obvious from the Samba

mailing list back in 2000 and 2001 when there were few postings regarding GPOs and

how to replicate them in a Samba environment.

</p><p>

Judging by the traffic volume since mid 2002, GPOs have become a standard part of

the deployment in many sites. This chapter reviews techniques and methods that can

be used to exploit opportunities for automation of control over user desktops and

network client workstations.

</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2658876"></a>Creating and Managing System Policies</h2></div></div></div><p>

Under MS Windows platforms, particularly those following the release of MS Windows

NT4 and MS Windows 95, it is possible to create a type of file that would be placed

in the NETLOGON share of a domain controller. As the client logs onto the network,

this file is read and the contents initiate changes to the registry of the client

machine. This file allows changes to be made to those parts of the registry that

affect users, groups of users, or machines.

</p><p>

For MS Windows 9x/Me, this file must be called <code class="filename">Config.POL</code> and may

be generated using a tool called <code class="filename">poledit.exe</code>, better known as the

Policy Editor. The policy editor was provided on the Windows 98 installation CD-ROM, but

disappeared again with the introduction of MS Windows Me. From

comments of MS Windows network administrators, it would appear that this tool became

a part of the MS Windows Me Resource Kit.

</p><p>

MS Windows NT4 server products include the <span class="emphasis"><em>System Policy Editor</em></span>

under <span class="guimenu">Start -> Programs -> Administrative Tools</span>.

For MS Windows NT4 and later clients, this file must be called <code class="filename">NTConfig.POL</code>.

</p><p>

New with the introduction of MS Windows 2000 was the Microsoft Management Console

or MMC. This tool is the new wave in the ever-changing landscape of Microsoft

methods for management of network access and security. Every new Microsoft product

or technology seems to make the old rules obsolete and introduces newer and more

complex tools and methods. To Microsoft's credit, the MMC does appear to

be a step forward, but improved functionality comes at a great price.

</p><p>

Before embarking on the configuration of network and system policies, it is highly

advisable to read the documentation available from Microsoft's Web site regarding

Implementing Profiles and Policies in Windows NT 4.0</a>.

There are a large number of documents in addition to this old one that should also

be read and understood. Try searching on the Microsoft Web site for “<span class="quote">Group Policies</span>”.

</p><p>

What follows is a brief discussion with some helpful notes. The information provided

here is incomplete you are warned.

</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2659065"></a>Windows 9x/ME Policies</h3></div></div></div><p>

You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/Me.

It can be found on the original full-product Windows 98 installation CD-ROM under

<code class="filename">tools\reskit\netadmin\poledit</code>. Install this using the

Add/Remove Programs facility, and then click on <span class="guiicon">Have Disk</span>.

</p><p>

Use the Group Policy Editor to create a policy file that specifies the location of

user profiles and/or <code class="filename">My Documents</code>, and so on. Then save these

settings in a file called <code class="filename">Config.POL</code> that needs to be placed in the

root of the <em class="parameter"><code>[NETLOGON]</code></em> share. If Windows 98 is configured to log onto

the Samba domain, it will automatically read this file and update the Windows 9x/Me registry

of the machine as it logs on.

</p><p>

100

Further details are covered in the Windows 98 Resource Kit documentation.

101

</p><p>

102

103

If you do not take the correct steps, then every so often Windows 9x/Me will check the

104

integrity of the registry and restore its settings from the backup

105

copy of the registry it stores on each Windows 9x/Me machine. So, you will

106

occasionally notice things changing back to the original settings.

107

</p><p>

108

109

110

Install the Group Policy handler for Windows 9x/Me to pick up Group Policies. Look on the

111

Windows 98 CD-ROM in <code class="filename">\tools\reskit\netadmin\poledit</code>.

112

Install Group Policies on a Windows 9x/Me client by double-clicking on

113

<code class="filename">grouppol.inf</code>. Log off and on again a couple of times and see

114

if Windows 98 picks up Group Policies. Unfortunately, this needs to be done on every

115

Windows 9x/Me machine that uses Group Policies.

116

</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2659202"></a>Windows NT4-Style Policy Files</h3></div></div></div><p>

117

118

119

120

121

To create or edit <code class="filename">ntconfig.pol</code>, you must use the NT Server

122

Policy Editor, <code class="literal">poledit.exe</code>, which is included with NT4 Server

123

but not with NT workstation. There is a Policy Editor on an NT4

124

Workstation but it is not suitable for creating domain policies.

125

Furthermore, although the Windows 95 Policy Editor can be installed on an NT4

126

workstation/server, it will not work with NT clients. However, the files from

127

the NT Server will run happily enough on an NT4 workstation.

128

</p><p>

129

130

131

132

133

You need <code class="filename">poledit.exe</code>, <code class="filename">common.adm</code>, and <code class="filename">winnt.adm</code>.

134

It is convenient to put the two <code class="filename">*.adm</code> files in the <code class="filename">c:\winnt\inf</code>

135

directory, which is where the binary will look for them unless told otherwise. This

136

directory is normally “<span class="quote">hidden.</span>”

137

</p><p>

138

139

140

141

142

The Windows NT Policy Editor is also included with the Service Pack 3 (and

143

later) for Windows NT 4.0. Extract the files using <code class="literal">servicepackname /x</code>

144

that's <code class="literal">Nt4sp6ai.exe /x</code> for Service Pack 6a. The Policy Editor,

145

<code class="literal">poledit.exe</code>, and the associated template files (*.adm) should

146

be extracted as well. It is also possible to download the policy template

147

files for Office97 and get a copy of the Policy Editor. Another possible

148

location is with the Zero Administration Kit available for download from Microsoft.

149

</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2659384"></a>Registry Spoiling</h4></div></div></div><p>

150

151

152

With NT4-style registry-based policy changes, a large number of settings are not

153

automatically reversed as the user logs off. The settings that were in the

154

<code class="filename">NTConfig.POL</code> file were applied to the client machine registry and apply to the

155

hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known

156

as tattooing. It can have serious consequences downstream, and the administrator must

157

be extremely careful not to lock out the ability to manage the machine at a later date.

158

</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2659424"></a>MS Windows 200x/XP Professional Policies</h3></div></div></div><p>

159

160

Windows NT4 system policies allow the setting of registry parameters specific to

161

users, groups, and computers (client workstations) that are members of the NT4-style

162

domain. Such policy files will work with MS Windows 200x/XP clients also.

163

</p><p>

164

New to MS Windows 2000, Microsoft recently introduced a style of Group Policy that confers

165

a superset of capabilities compared with NT4-style policies. Obviously, the tool used

166

to create them is different, and the mechanism for implementing them is much improved.

167

</p><p>

168

169

170

The older NT4-style registry-based policies are known as <span class="emphasis"><em>Administrative Templates</em></span>

171

in MS Windows 2000/XP GPOs. The latter includes the ability to set various security

172

configurations, enforce Internet Explorer browser settings, change and redirect aspects of the

173

users desktop (including the location of <code class="filename">My Documents</code> files, as

174

well as intrinsics of where menu items will appear in the Start menu). An additional new

175

feature is the ability to make available particular software Windows applications to particular

176

users and/or groups.

177

</p><p>

178

179

180

181

Remember, NT4 policy files are named <code class="filename">NTConfig.POL</code> and are stored in the root

182

of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username and password

183

and selects the domain name to which the logon will attempt to take place. During the logon process,

184

the client machine reads the <code class="filename">NTConfig.POL</code> file from the NETLOGON share on

185

the authenticating server and modifies the local registry values according to the settings in this file.

186

</p><p>

187

188

189

190

191

192

193

194

195

Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of

196

a Windows 200x policy file is stored in the Active Directory itself and the other part is stored

197

in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active

198

Directory domain controllers. The part that is stored in the Active Directory itself is called the

199

Group Policy Container (GPC), and the part that is stored in the replicated share called SYSVOL is

200

known as the Group Policy Template (GPT).

201

</p><p>

202

203

With NT4 clients, the policy file is read and executed only as each user logs onto the network.

204

MS Windows 200x policies are much more complex GPOs are processed and applied at client machine

205

startup (machine specific part), and when the user logs onto the network, the user-specific part

206

is applied. In MS Windows 200x-style policy management, each machine and/or user may be subject

207

to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows

208

the administrator to also set filters over the policy settings. No such equivalent capability

209

exists with NT4-style policy files.

210

</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2659627"></a>Administration of Windows 200x/XP Policies</h4></div></div></div><p>

211

212

213

214

215

216

Instead of using the tool called <span class="application">the System Policy Editor</span>, commonly called Poledit (from the

217

executable name <code class="literal">poledit.exe</code>), <acronym class="acronym">GPOs</acronym> are created and managed using a

218

<span class="application">Microsoft Management Console</span> <acronym class="acronym">(MMC)</acronym> snap-in as follows:</p><div class="procedure"><ol type="1"><li><p>

219

Go to the Windows 200x/XP menu <span class="guimenu">Start->Programs->Administrative Tools</span>

220

and select the MMC snap-in called <span class="guimenuitem">Active Directory Users and Computers</span>

221

</p></li><li><p>

222

223

Select the domain or organizational unit (OU) that you wish to manage, then right-click

224

to open the context menu for that object, and select the <span class="guibutton">Properties</span>.

225

</p></li><li><p>

226

Left-click on the <span class="guilabel">Group Policy</span> tab, then

227

left-click on the New tab. Type a name

228

for the new policy you will create.

229

</p></li><li><p>

230

Left-click on the <span class="guilabel">Edit</span> tab to commence the steps needed to create the GPO.

231

</p></li></ol></div><p>

232

All policy configuration options are controlled through the use of policy administrative

233

templates. These files have an .adm extension, both in NT4 as well as in Windows 200x/XP.

234

Beware, however, the .adm files are not interchangeable across NT4 and Windows 200x.

235

The latter introduces many new features as well as extended definition capabilities. It is

236

well beyond the scope of this documentation to explain how to program .adm files; for that,

237

refer to the Microsoft Windows Resource Kit for your particular

238

version of MS Windows.

239

</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>

240

241

242

243

The MS Windows 2000 Resource Kit contains a tool called <code class="literal">gpolmig.exe</code>. This tool can be used

244

to migrate an NT4 <code class="filename">NTConfig.POL</code> file into a Windows 200x style GPO. Be VERY careful how you

245

use this powerful tool. Please refer to the resource kit manuals for specific usage information.

246

</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2659832"></a>Custom System Policy Templates</h4></div></div></div><p>

247

Over the past year, there has been a bit of talk regarding the creation of customized

248

templates for the Windows Sytem Policy Editor. A recent announcement on the Samba mailing

249

list is worthy of mention.

250

</p><p>

251

Mike Petersen has announced the availability of a template file he has created. This custom System Policy

252

Editor Template will allow you to successfully control Microsoft Windows workstations from an SMB server, such

253

as Samba. This template has been tested on a few networks, although if you find any problems with any of these

254

policies, or have any ideas for additional policies, let me know at mailto:mgpeter@pcc-services.com. This

255

Template includes many policies for Windows XP to allow it to behave better in a professional environment.

256

</p><p>

257

For further information please see the <a class="ulink" href="http://www.pcc-services.com/custom_poledit.html" target="_top">Petersen</a> Computer Consulting web site. There is

258

a download link for the template file.

259

</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2659873"></a>Managing Account/User Policies</h2></div></div></div><p>

260

261

262

263

Policies can define a specific user's settings or the settings for a group of users. The resulting

264

policy file contains the registry settings for all users, groups, and computers that will be using

265

the policy file. Separate policy files for each user, group, or computer are not necessary.

266

</p><p>

267

268

If you create a policy that will be automatically downloaded from validating domain controllers,

269

you should name the file <code class="filename">NTConfig.POL</code>. As system administrator, you have the option of renaming the

270

policy file and, by modifying the Windows NT-based workstation, directing the computer to update

271

the policy from a manual path. You can do this by either manually changing the registry or by using

272

the System Policy Editor. This can even be a local path such that each machine has its own policy file,

273

but if a change is necessary to all machines, it must be made individually to each workstation.

274

</p><p>

275

276

277

When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on

278

the authenticating domain controller for the presence of the <code class="filename">NTConfig.POL</code> file. If one exists, it is

279

downloaded, parsed, and then applied to the user's part of the registry.

280

</p><p>

281

282

283

284

285

MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally

286

acquire policy settings through GPOs that are defined and stored in Active Directory

287

itself. The key benefit of using AD GPOs is that they impose no registry <span class="emphasis"><em>spoiling</em></span> effect.

288

This has considerable advantage compared with the use of <code class="filename">NTConfig.POL</code> (NT4) style policy updates.

289

</p><p>

290

291

292

In addition to user access controls that may be imposed or applied via system and/or group policies

293

in a manner that works in conjunction with user profiles, the user management environment under

294

MS Windows NT4/200x/XP allows per-domain as well as per-user account restrictions to be applied.

295

Common restrictions that are frequently used include:

296

</p><p>

297

298

</p><div class="itemizedlist"><ul type="disc"><li><p>Logon hours</p></li><li><p>Password aging</p></li><li><p>Permitted logon from certain machines only</p></li><li><p>Account type (local or global)</p></li><li><p>User rights</p></li></ul></div><p>

299

</p><p>

300

301

302

Samba-3.0.20 does not yet implement all account controls that are common to MS Windows NT4/200x/XP.

303

While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password

304

expiry is functional today. Most of the remaining controls at this time have only stub routines

305

that may eventually be completed to provide actual control. Do not be misled by the fact that a

306

parameter can be set using the NT4 Domain User Manager or in the <code class="filename">NTConfig.POL</code>.

307

</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2660100"></a>Management Tools</h2></div></div></div><p>

308

Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools.

309

The following sections describe a few key tools that will help you to create a low-maintenance user

310

environment.

311

</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660112"></a>Samba Editreg Toolset</h3></div></div></div><p>

312

313

314

315

A new tool called <code class="literal">editreg</code> is under development. This tool can be used

316

to edit registry files (called <code class="filename">NTUser.DAT</code>) that are stored in user

317

and group profiles. <code class="filename">NTConfig.POL</code> files have the same structure as the

318

<code class="filename">NTUser.DAT</code> file and can be edited using this tool. <code class="literal">editreg</code>

319

is being built with the intent to enable <code class="filename">NTConfig.POL</code> files to be saved in text format and to

320

permit the building of new <code class="filename">NTConfig.POL</code> files with extended capabilities. It is proving difficult

321

to realize this capability, so do not be surprised if this feature does not materialize. Formal

322

capabilities will be announced at the time that this tool is released for production use.

323

</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660194"></a>Windows NT4/200x</h3></div></div></div><p>

324

325

326

327

The tools that may be used to configure these types of controls from the MS Windows environment are

328

the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe).

329

Under MS Windows 200x/XP, this is done using the MMC with appropriate

330

“<span class="quote">snap-ins,</span>” the registry editor, and potentially also the NT4 System and Group Policy Editor.

331

</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660235"></a>Samba PDC</h3></div></div></div><p>

332

333

334

335

336

With a Samba domain controller, the new tools for managing user account and policy information include:

337

<code class="literal">smbpasswd</code>, <code class="literal">pdbedit</code>, <code class="literal">net</code>, and <code class="literal">rpcclient</code>.

338

The administrator should read the man pages for these tools and become familiar with their use.

339

</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2660299"></a>System Startup and Logon Processing Overview</h2></div></div></div><p>

340

The following attempts to document the order of processing the system and user policies following a system

341

reboot and as part of the user logon:

342

</p><div class="orderedlist"><ol type="1"><li><p>

343

344

345

Network starts, then Remote Procedure Call System Service (RPCSS) and multiple universal naming

346

convention provider (MUP) start.

347

</p></li><li><p>

348

349

350

Where Active Directory is involved, an ordered list of GPOs is downloaded

351

and applied. The list may include GPOs that:

352

</p><div class="itemizedlist"><ul type="disc"><li><p>Apply to the location of machines in a directory.</p></li><li><p>Apply only when settings have changed.</p></li><li><p>Depend on configuration of the scope of applicability: local,

353

site, domain, organizational unit, and so on.</p></li></ul></div><p>

354

No desktop user interface is presented until the above have been processed.

355

</p></li><li><p>

356

Execution of startup scripts (hidden and synchronous by default).

357

</p></li><li><p>

358

A keyboard action to effect start of logon (Ctrl-Alt-Del).

359

</p></li><li><p>

360

User credentials are validated, user profile is loaded (depends on policy settings).

361

</p></li><li><p>

362

An ordered list of user GPOs is obtained. The list contents depends on what is configured in respect of:

363

364

</p><div class="itemizedlist"><ul type="disc"><li><p>Is the user a domain member, thus subject to particular policies?</p></li><li><p>Loopback enablement, and the state of the loopback policy (merge or replace).</p></li><li><p>Location of the Active Directory itself.</p></li><li><p>Has the list of GPOs changed? No processing is needed if not changed.</p></li></ul></div><p>

365

</p></li><li><p>

366

User policies are applied from Active Directory. Note: There are several types.

367

</p></li><li><p>

368

Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on GPOs

369

(hidden and executed synchronously). NT4-style logon scripts are then run in a normal

370

window.

371

</p></li><li><p>

372

The user interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4

373

domain), machine (system) policies are applied at startup; user policies are applied at logon.

374

</p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2660457"></a>Common Errors</h2></div></div></div><p>

375

Policy-related problems can be quite difficult to diagnose and even more difficult to rectify. The following

376

collection demonstrates only basic issues.

377

</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660469"></a>Policy Does Not Work</h3></div></div></div><p>

378

“<span class="quote">We have created the <code class="filename">Config.POL</code> file and put it in the <span class="emphasis"><em>NETLOGON</em></span> share.

379

It has made no difference to our Win XP Pro machines, they just do not see it. It worked fine with Win 98 but does not

380

work any longer since we upgraded to Win XP Pro. Any hints?</span>”

381

</p><p>

382

Policy files are not portable between Windows 9x/Me and MS Windows NT4/200x/XP-based platforms. You need to

383

use the NT4 Group Policy Editor to create a file called <code class="filename">NTConfig.POL</code> so it is in the

384

correct format for your MS Windows XP Pro clients.

385

</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�25.�Advanced Network Management�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�27.�Desktop Profile Management</td></tr></table></div></body></html>