Computer Extensible Policies | Novell ZENworks for Desktops 4 Administrators Handbook

Microsoft requires that software packages that bear the Windows approved logo be capable of being configured through .POL files. The poledit program enables you to edit these extensible policies and include them in the system .POL file. ZENworks also enables the policies that are stored in eDirectory to accept these additional extensible polices and provide them to all of the users who are associated with these policies.

The User Extensible policy enables you to import these special .ADM files into the eDirectory tree and administer and disperse them to the users associated with the policy package. Once these .ADM files have been imported into the tree, they can be administrated and associated to users in the eDirectory tree. These settings are applied like the User System Policies.

The NDS Rights, Other, and Rights to Files and Folders pages are described in the "Setting Up a Workstation Policy Package" section.

Computer Extensible Policies Page

When you first bring up the Computer Extensible Policies page, you are presented with the Computer Extensible Policies page. An example of this page is displayed in Figure 9.5.

Figure 9.5. Computer Extensible Policies page of the User Extensible Policies policy.

graphics/09fig05.jpg

This page is split into three areas: ADM files, Policies, Policy specific window in the bottom-right corner.

The files in the ADM file list are the policies that are applied to the users associated with this policy. To add a policy file to the list, simply press the Add button. You are presented with a file dialog box where you can browse and select the file. Remember that this file should reside on the server, as it is stored there for retrieval by the policy managers. When you browse and select a file, make sure it is on the server, and that the drive that you use is mapped correctly for all users who are associated with the policy. You can enter a UNC path in the filename field of the dialog box and thereby get a UNC path for the ADM file; however, if you browse and then select, the program puts a drive letter into the path, thus necessitating that each user have the same drive mapping.

When this policy is initialized, four .ADM files are automatically pulled in by the plug-in into ConsoleOne. These include ADMIN.ADM, COMMON.ADM, WINNT.ADM, and ZAKWINNT.ADM. Each of these files is stored in the ConsoleOne\1.2\bin\zen\admfiles directory and they are considered the default packages.

NOTE

Other .ADM files are available depending on which version of Windows you are running on your workstation. For example, Windows 2000 clients also include SYSTEM.ADM; there is an INETRES.ADM file for restricting Internet Explorer.

NOTE

The .ADM file must be stored on a server on which users have access. The policy references the .ADM file and needs to retrieve it to apply it to the users and to enable the administrators to modify the settings. It's recommended, therefore, that you use a UNC path to specify the location of the file.

You delete the .ADM file from the applied set by selecting the file and pressing the Remove button.

You can also modify the settings of the .ADM files by selecting the file in the ADM files windows. When you select the file, its Registry content is displayed in the Policies window. The user interface for this window mimics the poledit program available from Microsoft. The small window underneath the Policies box displays information about the selected Registry setting along with any subsetting categories. Double-click the key in the policies window to populate this details field.

You can browse through the ADM files and turn them on, turn them off, or leave them as set in the Registry as you can in the poledit program. Once you have made your changes, press Apply or OK to update the ADM files on the server.

Policy Schedule Page

The Policy Schedule page enables you to customize (outside of the package default schedule) when you want the ADM files applied to the user's workstation/desktop.

This page enables you to select when the package should be applied: Event, Daily, Weekly, Monthly, or Yearly.

Once you have selected when you want the package applied, you have additional fields to select in the lower portion of the screen. The following sections discuss the various options.

Event

When you choose to have the ADM files applied on an event that occurs in the workstation, you have the additional need to select which event affects the changes.

You can select from one of the following events:

User Login This causes the policies to be applied when the user logs into the system. This happens after the users enter their username and password, but before their desktop is shown and the user login scripts have started.
User Desktop Is Active This runs the policies after the user has logged into the system and all login scripts have been completed but before the desktop is displayed. This is available with Windows servers only.
Workstation Is Locked This causes the policies to be applied when the workstation is locked (such as when the screen saver is activated and is locked awaiting a password). This is available with Windows servers only.
Workstation Is Unlocked This runs the policies when the workstation becomes unlocked, after the user has supplied a password to unlock the system. This is available with Windows servers only.
Screen Saver Is Activated This runs the policies when the screen saver is activated on an idle system.
User Logout This applies the policies when the user logs out of the system.
System Shutdown This applies the policies when a system shutdown is requested.

Daily

When you choose to have the ADM files applied daily on the workstation, you need to indicate when the changes are made.

This schedule requires that you select the days when you want the policy applied. You select the days by clicking on the days you desire. The selected days appear as pressed buttons.

In addition to the days, you can select the times the policies are applied. These start and stop times provide a range of time where the policies are applied.

To keep all workstations from simultaneously accessing the servers, you can select the Randomly Dispatch Policy During Time Period option. This causes each workstation to choose a random time within the time period when they will retrieve and apply the policy.

You can have the policy also reapplied to each workstation within the timeframe every specified hour/minute/second by clicking the Repeat the Action Every Field and then specifying the time delay. This results in a scheduled action being run on every associated user's workstation for the selected repeat time.

Weekly

You can alternatively choose that the policies be applied only weekly.

In this screen, you choose which day of the week you want the policy to be applied. You can select only one day at a time. Once you have selected the day, you can also select a time range.

Monthly

Under the monthly schedule, you can select which day of the month the policy should be applied or you can select Last day of the month to handle the last day because all months obviously do not end on the same calendar date.

Once you have selected the day, you can also select the time range.

Yearly

Select a yearly schedule when you want to apply the policies only once a year.

On this screen you must choose the day that you want the policies to be applied. You do this by selecting the calendar button to the right of the Date field. This brings up a monthly dialog box where you can browse through the calendar to select the date you want. This calendar does not correspond to any particular year and might not take into account leap years in its display. This is because you are choosing a date for each year that will come along in the present and future years.

Once you have selected the date, you can also select the time range for the policy.

Advanced Settings

On each of the scheduling pages you have the option of selecting the Advanced Settings button. It affords you some additional control on the scheduled action that is placed on each user's workstation.

When first displayed, the Completion tab is activated. The following sections describe each field on the tabs and how they relate to the action.

Completion

The Completion tab enables you to specify what should happen on the workstation once the scheduled action has completed. You can choose any of the following by selecting the check box next to the appropriate items:

Disable the Action After Completion This stops the action from being rescheduled after completion. If you chose to apply the policy every hour, choosing this turns off that action. The policy is not reapplied. This rescheduling only occurs and is reset when the user logs off and back onto the system.
Reboot After Completion This causes the workstation to reboot after applying the policies.
Prompt the User Before Rebooting This enables the user to be prompted before rebooting. The user can cancel the reboot.

Fault

This tab enables you to specify what should occur if the scheduled action fails in its completion.

The following choices are available to failed actions:

Disable the Action This results in the action being disabled and not rescheduled or rerun.
Retry Every Minute This attempts to rerun the action every minute despite the schedule that might have been specified in the policy.
Ignore the Error and Reschedule Normally This assumes that the action ran normally and reschedules the action according to the policy.

Impersonation

These settings enable you to specify the account that should be used when running the action. The following choices are available for the user type that is used to run the scheduled item:

Interactive User This runs the action with the rights of the currently logged in user. This should be used if it is acceptable to run this action and not have access to the secure portions of the Registry, as most local users do not have access to the secured portions of the Registry or file system.
System This runs the action in the background with administrative privileges. This impersonation level should be used only if the action has no user interface and requires no interaction with the user.
Unsecure System This runs the action as a system described above but enables user interaction. This is only available on Windows servers and should be used with care because normally Windows NT does not allow a cross-over between user and system space.

Priority

This tab enables you to specify at which level you want the action to run on the workstation. The following choices are available within the priority schedule:

Below Normal This schedules the actions at a priority that is below the normal user activity. This level does not interfere with the behavior of the system and it gives the user a normal experience.
Normal This schedules the action at the same level as any user activity. This can cause the workstation to perform at a slower level because the service is competing with the user for resources.
Above Normal This level schedules the action at a higher priority than the user requests and results in being completed before user activity is serviced.

Time Limit

This tab of the scheduled advanced settings enables you to specify how long the service should be allowed to run before it is terminated. This can be used to protect yourself from having the action run for long periods of time on the workstation. Terminating the action, though, might prevent the action from completing properly. Therefore, because you usually want the action to fully complete, this tab is not normally used.