Chapter 23. System and Account Policies

This chapter summarises the current state of knowledge derived from personal practice and knowledge from samba mailing list subscribers. Before reproduction of posted information effort has been made to validate the information provided. Where additional information was uncovered through this validation it is provided also. -

Features and Benefits

-When MS Windows NT3.5 was introduced the hot new topic was the ability to implmement +

Features and Benefits

+When MS Windows NT3.5 was introduced the hot new topic was the ability to implement Group Policies for users and group. Then along came MS Windows NT4 and a few sites started to adopt this capability. How do we know that? By way of the number of "booboos" (or mistakes) administrators made and then requested help to resolve. @@ -26,7 +25,7 @@ network client workstations.

A tool new to Samba-3 may become an important part of the future Samba Administrators' arsenal. The editreg tool is described in this document. -

Creating and Managing System Policies

Under MS Windows platforms, particularly those following the release of MS Windows NT4 and MS Windows 95) it is possible to create a type of file that would be placed in the NETLOGON share of a domain controller. As the client logs onto the network @@ -37,7 +36,7 @@ affect users, groups of users, or machines. For MS Windows 9x/Me this file must be called Config.POL and may be generated using a tool called poledit.exe, better known as the Policy Editor. The policy editor was provided on the Windows 98 installation CD, but -dissappeared again with the introduction of MS Windows Me (Millenium Edition). From +disappeared again with the introduction of MS Windows Me (Millennium Edition). From comments from MS Windows network administrators it would appear that this tool became a part of the MS Windows Me Resource Kit.

@@ -61,7 +60,7 @@ be read and understood. Try searching on the Microsoft web site for "Group

What follows is a very brief discussion with some helpful notes. The information provided here is incomplete - you are warned. -

Windows 9x/Me Policies

You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. It can be found on the Original full product Win98 installation CD under tools/reskit/netadmin/poledit. Install this using the @@ -87,7 +86,7 @@ here is incomplete - you are warned. grouppol.inf. Log off and on again a couple of times and see if Win98 picks up group policies. Unfortunately this needs to be done on every Win9x/Me machine that uses group policies. -

Windows NT4 Style Policy Files

To create or edit ntconfig.pol you must use the NT Server Policy Editor, poledit.exe which is included with NT4 Server but not NT Workstation. There is a Policy Editor on a NT4 @@ -108,14 +107,14 @@ here is incomplete - you are warned. be extracted as well. It is also possible to downloaded the policy template files for Office97 and get a copy of the policy editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. -

Registry Spoiling

With NT4 style registry based policy changes, a large number of settings are not automatically reversed as the user logs off. Since the settings that were in the NTConfig.POL file were applied to the client machine registry and that apply to the hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known as tattooing. It can have serious consequences down-stream and the administrator must be extremely careful not to lock out the ability to manage the machine at a later date. -

MS Windows 200x / XP Professional Policies

Windows NT4 System policies allows setting of registry parameters specific to users, groups and computers (client workstations) that are members of the NT4 style domain. Such policy file will work with MS Windows 2000 / XP clients also. @@ -149,10 +148,10 @@ here is incomplete - you are warned. MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine startup (machine specific part) and when the user logs onto the network the user specific part is applied. In MS Windows 200x style policy management each machine and/or user may be subject - to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows + to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows the administrator to also set filters over the policy settings. No such equivalent capability exists with NT4 style policy files. -

Administration of Win2K / XP Policies

Instead of using the tool called The System Policy Editor, commonly called Poledit (from the executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console (MMC) snap-in as follows:

@@ -169,16 +168,16 @@ here is incomplete - you are warned.

All policy configuration options are controlled through the use of policy administrative templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. - Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. + Beware however, since the .adm files are NOT interchangeable across NT4 and Windows 200x. The later introduces many new features as well as extended definition capabilities. It is well beyond the scope of this documentation to explain how to program .adm files, for that - the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular + the administrator is referred to the Microsoft Windows Resource Kit for your particular version of MS Windows.

Note

The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you use this powerful tool. Please refer to the resource kit manuals for specific usage information. -

Managing Account/User Policies

Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using the policy file. Separate policy files for each user, group, or computer are not not necessary. @@ -197,48 +196,48 @@ applied to the user's part of the registry. MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory itself. The key benefit of using AS GPOs is that they impose no registry spoiling effect. -This has considerable advanage compared with the use of NTConfig.POL (NT4) style policy updates. +This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates.

In addition to user access controls that may be imposed or applied via system and/or group policies in a manner that works in conjunction with user profiles, the user management environment under MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. Common restrictions that are frequently used includes: -

Logon Hours

Password Aging

Permitted Logon from certain machines only

Account type (Local or Global)

User Rights

Samba Editreg Toolset

Logon Hours

Password Aging

Permitted Logon from certain machines only

Account type (Local or Global)

User Rights

Samba Editreg Toolset

Describe in detail the benefits of editreg and how to use it. -

Windows NT4/200x

The tools that may be used to configure these types of controls from the MS Windows environment are: The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). - Under MS Windows 200x/XP this is done using the Microsoft Managment Console (MMC) with approapriate + Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. -

Samba PDC

With a Samba Domain Controller, the new tools for managing of user account and policy information includes: smbpasswd, pdbedit, net, rpcclient. The administrator should read the man pages for these tools and become familiar with their use. -

System Startup and Logon Processing Overview

The following attempts to document the order of processing of system and user policies following a system reboot and as part of the user logon:

Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming Convention Provider (MUP) start -
+
Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded and applied. The list may include GPOs that: -
Apply to the location of machines in a Directory
Apply only when settings have changed
Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.
+
Apply to the location of machines in a Directory
Apply only when settings have changed
Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.
No desktop user interface is presented until the above have been processed. -
- Execution of start-up scripts (hidden and synchronous by defaut). +
+ Execution of start-up scripts (hidden and synchronous by default).
A keyboard action to affect start of logon (Ctrl-Alt-Del).
User credentials are validated, User profile is loaded (depends on policy settings). -
- An ordered list of User GPOs is obtained. The list contents depends on what is configured in respsect of: +

+ An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: -
Is user a domain member, thus subject to particular policies
Loopback enablement, and the state of the loopback policy (Merge or Replace)
Location of the Active Directory itself
Has the list of GPOs changed. No processing is needed if not changed.
-

Is user a domain member, thus subject to particular policies

Loopback enablement, and the state of the loopback policy (Merge or Replace)

Location of the Active Directory itself

Has the list of GPOs changed. No processing is needed if not changed.

User Policies are applied from Active Directory. Note: There are several types.
Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group @@ -247,10 +246,10 @@ reboot and as part of the user logon:
The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 Domain) machine (system) policies are applied at start-up, User policies are applied at logon. -

Common Errors

Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following collection demonstrates only basic issues. -

Policy Does Not Work

Question: We have created the config.pol file and put it in the NETLOGON share. It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not work any longer since we upgraded to Win XP Pro. Any hints? @@ -258,4 +257,4 @@ work any longer since we upgraded to Win XP Pro. Any hints? ANSWER: Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that it is in the correct format for your MS Windows XP Pro clients. -

Prev	Up	Next
Chapter 22. Advanced Network Manangement	Home	Chapter 24. Desktop Profile Management

Prev	Up	Next
Chapter 22. Advanced Network Management	Home	Chapter 24. Desktop Profile Management