AdminXP.com: System policy in Windows NT

System policy in Windows NT

poledit.exe

Definition collection rules determining potentialities and user right
Editing policy - System policy editor (administrative tools or menu start Start - Run.. and write poledit.exe) - set-up rules for single computer, user group and single user - simple edit some item in register
For implementation policy in domains -save file policy as Ntconfig.pol and save him on primary domain controller in folders %Systemroot%\system32\Repl\Impor\Scripts (sharing directory with name NETLOGON). Start replication to copying file on all backup domain controller.
In case using policy for Windows 95 and Windows NT for both platforms must start creation policy on every platforms separately in Windows 95 then originates config.pol and in Windows NT is it ntconfig.pol.
At login to domain load user's profile and assert oneself system policy from file ntconfig.pol - if for specific user exists specific policy – are setting those policy insert into parts register relevant actual user HKEY_CURRENT_USER
If isn't definition policy. Can be use policy for group , to which user belongs. If si user member several group is use policy from group with biggest priority and inserts into subtree HKEY_CURRENT_USER
Priority it is possible define in System policy editor in menu Options and command Group priority
If for user neither his group isn't definition no policy inserts into subtree HKEY_CURRENT_USER setting default policy "Default User"
In case specific policy (Add computer) - inserts policy on specific computer into parts register: HKEY_LOCAL:MACHINE in opposite case - insert policy from "Default computer"

Editor

File

New policy – Create new system policy
Open policy - Display and edits existing policy.
Open registry – Display and edits register. Changes will apply only on your computer.
Save - Storage changes in register or open file policy.
Save as - Save as new policy file. (typically ntconfig.pol for Windows NT)
Close - Close policy editor.
Connect - Changes setting in register remote computer.

Edit

Addition or removing administrative units (user or computer), editing units.
Add user - Add policy for individual user.
Add computer - Add policy for individual computer ro workgroup. (add computer, browse, choose and OK)
Add group - Add policy for user group.

Next

View - Chances of set up design policy editor - option for icons sizes and switching off or switching on toolbars.
Options - Selection templates for policy - only for expert, in case other templates will not some selection available or will completely different. Choice priority group insider - choice group with greatest importance.
Help - Additional information.

Check box

Grey – register key is unchanging for this item – implicit setting
Check - apply settings for policy
Not check - not apply for policy or revoke previous setting - necessary check for administrator.

Policy for Computer

Network - Setting for remote updating (automatic or manual settings parameter for updating policy).
System - Setting program starting at login (Name - name.exe).
Windows NT Network - Automatic creation administrator (hidden) sharing (C$, D$) for workstation or server.
Windows NT Printers -Restriction identification network printers for other servers, setting priority for printing, activation audio signal in case errors.
Windows NT Remote Access - Maximum number unsuccessful login, Maximum time for authentication, waiting time for calling back, specification time inactivity for client disconnection.
Windows NT Shell - Creation environment for all user.
Windows NT System - Display text (notice) before login, Display potentialities shutdown computer, do not display names last logged of user name and setting as to character file system.
Windows NT User Profiles - Erasure temporary profile from disk after login, Autodetect slow connection.

Policy for User0

Control panel - Restriction or prevention access to panel display.
Desktop - Specify wallpaper and color scheme.
Shell - Restriction for desktop , limitation used command find, run, shutdown.
System - Restriction use editor register and specification application which user can start.
Windows NT Shell - Conformation desktop setting ways in own folders programs and configuration item in menu start, some restriction.
Windows NT System - Inclusion variable in file autoexec.bat into user's setting, prevention logout, denied start application Task manager, and some next setting.
Windows NT User profiles - Setting for user's profiles (maximum size for user's profile and message notice overrun limit).

Policy for NT

Poledit - Administration tools - System policy editor
Save file as ntconfig.pol to netlogon share on PDC

Policy for Windows 98

Poledit - CD_drive:\Tools\reskit\netadmin\poledit (Installation CD)
Save file as config.pol to netlogon share on PDC

Example for domain policy

Run system policy editor.
Choose new policy
Edit policy
Save as config.pol (for win98) or ntconfig.pol (for nt)
Copy to share netlogon on server (c:\winnt\system32\repl\import\scripts)