Hi,
For all you client administrators out there, I pose an interesting dilemma. Sure using group policy in addition to active directory is beautiful. But how about a scenario such as mine, where I am stuck in an NT 4.0 environment for another 6months to a year? I work at a state university and as I’m sure you can imagine, security has been an issue for quite some time. Running Win98 in our labs and teaching consoles has been a joke, and I am in the process of deploying Win2k in both places. So, how to implement tight group policies, while being easily able to switch to free administrator policies for support?? After soul-searching for weeks, I have come up with an answer, but it can be a huge hassle. Win2k comes with a program called WinInstallLE located in the valueadd/3rdparty/mgmt/winstle folder. What you can do is take a snapshot of the system before group policy changes and a snapshot after making the lock-down. Then edit the registry file created by the snapshots and pick out the registry entries that implemented the policies. Copy all these keys into a new registry file, put regedit4 at the top (to tell this file to make these changes to the registry) and save the file. Now double-click on the file, and bada-bing bada-boom, the group policy is implemented (sometimes a re-login is necessary). Now the question, how do I get it back to unrestricted access? Simply open up the file and put a dash inside of the first bracked for each key. For example [-hkey/machine…]. Now put these two registry files on the local administrator’s desktop, and tech support can login locally as administrator, apply unrestricted settings, relogin, do the necessary work, apply the restricted policies and logout. Although this method works, it is very time-consuming to setup. Any ideas on a better solution?