System Policies

System Policies are used to control the configuration of a machine or a users, such as whether a user can install new programs, adjust desktop settings, and so on. Windows 2000 System Policies are an updated version of the policies that were included in previous versions of Windows. Like the previous versions, in Windows 2000 you will use the System Policy Editor, poledit.exe, to configure Registry settings that control the local machine.

Normally, you should always use the Windows 2000 Group Policy to control your computers, however, there are some situations in which System Policies are useful:

• When you have to manage Windows 95, 98, or Me computers.

• When you have to manage Windows NT 4.0 Workstation or Server computers.

• When the Windows 2000 computer is a member of a Windows NT 4.0 domain.

• When you have to manage a standalone Windows 2000 computer.

In all these situations, an Active Directory based Group Policy is not available. The pre “Windows 2000 computers don't support Group Policy, so in a mixed environment, for the sake of consistency, you might want to standardize by using a common policy created using the System Policy Editor.

In addition, the Local Computer Policy is unable to create a policy that will support multiple users. So all users on a standalone computer will receive the same settings.

The System Policy Editor is not on the system menu; you must start it from the command line by entering poledit.exe . The editor allows you create policies that apply to single or multiple users, groups, or computers (see Figure 8.6).

Figure 8.6. The System Policy Editor.

The System Policy Editor comes with five administrative templates:

• Inetres.adm ” Installed by default. This template contains the settings for Internet Explorer policies.

• System.adm ” Installed by default. This template contains the settings for Windows 2000 clients .

• Common.adm ” This template contains user interface settings that are common to Windows 9x and Windows NT.

• Windows.adm ” This template contains user interface settings for Windows 9x.

• Winnt.adm ” This template contains user interface settings for Windows NT.

As shown in Figure 8.7, the editor allows you to select settings from the pre-installed templates to be applied to the selected objects.

Figure 8.7. The System Policy Editor, showing configuration settings.

System policies allow you control just about everything that you can imagine on a computer. These policies can be applied to a standalone computer, or to all computers and users in a domain. To apply the policies in a domain, put the ntconfig.pol file (or config.pol for Windows 9x computers) in the NETLOGON share of the domain controller that is hosting the Primary Domain Controller (PDC) Emulator role in your domain.