.png?width=100&auto=webp&quality=80&disable=upscale "Picture of John Savill")
.png?width=400&auto=webp&quality=80&disable=upscale "John Savill")
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
How can I implement locally based system policies?
John Savill
March 4, 1999
2 Min Read
A. Normally system policies are implemented on domain controllers tobe used on an entire domain however Microsoft do provide support for localsystem based policies.
There are two approaches possible:
Automatic Update Method
Share the %systemroot%System32ReplImportScripts folder (e.g.d:winntsystem32replimportscripts) as Netlogon.
Grant the group Everyone "Read" Permissions and the groupAdministrators "Full Control" to this share.
Start System Policy Editor (Poledit.exe).
On the File menu, click New Policy and make the changes for your policy.
On the File menu, click Save As, and then save the policy file in theNetlogon shared folder as Ntconfig.pol.
On the File menu, click Open Registry.
Double-click Local Computer, double-click Network, double-click SystemPolicies Update, and then click the Remote Update check box to select it.
In the Update Mode box, click Automatic (Use Default Path), and then clickOK. This has the effect of looking for policy updates from the Netlogon shareof the authenticating controller/machine automatically.
Save your policy to the location listed above as Ntconfig.pol, and thenquit Policy Editor.
Restart Windows NT for the changes in the policy to take effect.
This configuration allows you to use both a local and a domain-wide systempolicy, depending on which user account database the user logs on to. This isthe normal method domains use as when you logon to a domain the computer looksfor policies in the Netlogon share of the domain controller validating thelogon.
Remote Update Method
Start System Policy Editor (Poledit.exe) and make the changes for yourpolicy.
On the File menu, click Save As, and then save the policy file on your harddisk. For example, save the file as: c:tconfig.pol
On the File menu, click Open Registry.
Double-click Local Computer, double-click Network, double-click SystemPolicies Update, and then click the Remote Update check box to select it.
In the Update Mode box, click Manual (Use Specific Path), type a path namein the Path for Manual Update dialog box (for example,d:winntsystem32replimportscriptsNtconfig.pol), and then click OK. Notethat to display error messages if the policy file is not found when Windows NTstarts, you can click the Display Error Message check box to select it.
Save your policy to the location listed above as Ntconfig.pol, and thenquit Policy Editor. Note that while using the Manual Update, you may name thepolicy file anything you would like; just be sure to enter it into the path instep 5 above.
Restart Windows NT for the changes in the policy to take effect.
With this method the location of the policy file is given and so does notrequire the Netlogon share. I would recommend the first method 9 times out of10.
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
