Windows Forum

Ask something
Discussion Locked

Window XP Policies on NT Domain Network

0 helpful
9 replies

by pamelac

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Current configuration I have is NT4 server domain with NT 4 workstations.
I am upgrading workstations to Windows XP however servers are not being upgraded to 2000.
How do I configure XP GPO to be picked up from the NT Server.
I have over 200 users that currently I have many policy rules set for - example no access to etwork neighbourhood or control panel.
All suggestions greatly appreciated, If I upgraded servers to 2000 I realize this would be non issue however it is not an option atthis time.

Regards,
P Creighton

9 replies

by beermonster

Hi,
If you are sticking with your NT4 domain, then your only option domain wise is going to be the old NT policy files. In your position I would get a test xp box, apply all of the restrictions that you want across your domain members, then dumpthe settings out to a template file. Next you can apply the file to any XP machines as they are built, and hit your existing machines via a scheduled task on each. On any XP box, run secedit from the command line, and look at the help file that opens for full instructions on creating templates. Hope this helps.....

by pamelac

While this is fine for day to day users when IS Staff go to work on a system that has been locked down for a user they would either need to import a new template that unlocks the workstation vs simple log on and have a policy that unlocks asNT does based on Group membership,

by pamelac

While this is fine for day to day users when IS Staff go to work on a system that has been locked down for a user they would either need to import a new template that unlocks the workstation vs simple log on and have a policy that unlocks asNT does based on Group membership, greatly appreciate the idea any others

by pamelac

While this is fine for day to day users when IS Staff go to work on a system that has been locked down for a user they would either need to import a new template that unlocks the workstation vs simple log on and have a policy that unlocks asNT does based on Group membership, greatly appreciate the idea any others

by quake_sinatra

From the technet site:

If you deploy computers running Windows XP Professional in a domain that does not include Active Directory, you can manage desktops locally by implementing the following features:

Roaming User Profiles and Logon Scripts. When using either a Windows NT 4.0 domain or Active Directory, both roaming user profiles and logon scripts are configured on the user object.

Folder Redirection. You can redirect special folders to alternate locations, either to a local or network location. You do this by modifying the values under the following registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders.

Internet Explorer Maintenance. Instead of using Group Policy to control Internet Explorer settings, administrators can use the IEAK to apply settings to Internet Explorer clients using auto-configuration packages. The IEAK can be downloaded from the Microsoft IEAK Web site at http://www.microsoft.com/windows/ieak.

Administrative Templates (registry-based policy). Domain-based Group Policy processing requires that the User and/or Computer objects be located in Active Directory. If the User or Computer objects are located in a Windows NT 4.0 domain, then Windows NT 4.0 System Policy will be processed for whichever of these objects is located in that domain — this could be the Computer or User object, or both.

System Policy is defined as the policy mechanism used natively in Windows NT 4.0; it is a set of registry settings that together define the computer resources available to a group of users or an individual

by pamelac

Thank you for your assistance I actually found the following that resolved the problem in winxppro resource kit,
"A Windows XP Professional?based client processes System Policy if either the user or computer account exists in a Windows NT 4.0 domain. When a user logs on to a Windows XP Professional?based client in a Windows NT 4.0 domain and the client is running in the default Automatic mode, it checks the Netlogon share on the validating domain controller for the Ntconfig.pol file. If the client finds the file, it downloads it, parses it for user, group, and computer policy data, and then applies the appropriate settings. If the client does not locate the policy file on its validating domain controller, it does not check elsewhere. It is therefore critically important that the Ntconfig.pol file is replicated among the domain controllers performing authentication.
Creating Ntconfig.pol files based on Windows XP Professional .adm files
You can create Ntconfig.pol files based on the Windows XP Professional .adm files and apply these settings to Windows XP Professional?based clients. To do this, you need the Windows NT 4.0 System Policy Editor tool, Poledit.exe, which is installed with Windows 2000 Server and Advanced Server. You can install Poledit.exe on Windows XP Professional?based computers by installing the Administrative Tools package that is included on the Windows 2000 Server and Microsoft? Windows? 2000 Advanced Server operating system CDs.

To install Administrative Tools on a Windows XP Professional?based computer, open the i386 folder on the applicable Windows 2000 Server disc, and then double-click the Adminpak.msi file. Follow the instructions that appear in the Administrative Tools setup wizard.

When you install the Administrative Tools package, Poledit.exe and its supporting .adm files (Winnt.adm, Windows.adm, and Common.adm) are installed into the root \System directory an

This discussion is closed to new replies.