Re: Windows XP remember GP when removed from domain

From: Mark Renoden [MSFT] (markreno_at_online.microsoft.com)
Date: 08/24/04 

Date: Wed, 25 Aug 2004 08:29:28 +1000

Hi Keven

You can reset all security settings to the installation defaults with

secedit /configure /cfg "%SYSTEMROOT%\security\templates\setup security.inf"
/db "%SYSTEMROOT%\security\database\setup security.sdb" /log
"%SYSTEMROOT%\security\database\setup security.log" /verbose

(this is one line at the command prompt)

Depending on the function of the machine, you may want to then apply another
security template ... for example, if it were a member server you might use
basicsv.inf.

Kind regards 

-- 
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email 
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no rights.
"Keven" <anonymous@discussions.microsoft.com> wrote in message 
news:c0b701c489e7$a87ef600$a501280a@phx.gbl...
> Thanks for the info Mark, how do I remove those locks
> from the GPO so that I can edit the password requirements
> on this machine that is no longer part of the domain?
>
> Keven
>>-----Original Message-----
>>Hi Keven
>>
>>I'm actually surprised that the policies are being reset
> on the Windows 2000
>>machines.  What you're seeing on the Windows XP SP1
> machines is what I'd
>>expect.
>>
>>Security policy is an actual registry change that needs
> to be modified with
>>a new policy.  Perhaps your Windows 2000 machines
> actually have settings in
>>their local policy which is allowed to take effect once
> they are moved off
>>the domain and that is normally overridden by the domain
> policy?
>>
>>HTH
>>-- 
>>Mark Renoden [MSFT]
>>Windows Platform Support Team
>>Email: markreno@online.microsoft.com
>>
>>Please note you'll need to strip ".online" from my email
> address to email
>>me; I'll post a response back to the group.
>>
>>This posting is provided "AS IS" with no warranties, and
> confers no rights.
>>
>>"Keven" <darkslyther@no-spam.yahoo.com> wrote in message
>>news:bca301c4895b$ce235db0$a401280a@phx.gbl...
>>> My windows 2003 domain is set to have accounts lockout
>>> after so many attempts, to require at least 8 passwords
>>> etc.  On Windows 2000 machines if I remove a machine
> from
>>> the domain it always releases these policies back to
> the
>>> local GPO.  On my XP Box with SP1 if I remove the PC
> from
>>> the domain, these policies remain in force and are
> locked
>>> on the local station.  Is there a way to remove these
>>> locked policies not that the box is part of a workgroup
>>> again?  Thanks Keven
>>>
>>> If you reply direct please remove no-spam.
>>
>>
>>.
>>

Relevant Pages

  • Re: Cryptogram Comment
    ... Or had to go through setting up basic security for their ... > bother me with Windows questions. ... > machines are broken. ... and Linux and other open OS's make all patches FREE to redistribute. ...
    (sci.crypt)
  • Group Policy Case Solved
    ... I began with the "Security Options" under the Computer ... I modified the group policy from my Windows XP Pro workstation using ... many more settings than Windows 2000 does; ...
    (microsoft.public.win2000.security)
  • Re: Viewing Local Security Policy on Windows 2003 Member Server?
    ... Windows ships with a default security set up that is defined by regular security templates, ... Those templates can be view using the Security Templates editor MMC snap-in and can show you what the default settings are prior to joining a domain. ... Script Group Policy Settings with the GPExpert Scripting Toolkit for PowerShell! ... Visit the GPOGUY: http://www.gpoguy.com -- The Windows Group Policy Information Hub: ...
    (microsoft.public.windows.group_policy)
  • OT security on mainframe versus that on Windows was Re: RWs statement - what am I missing (was:
    ... One reason why Windows is so plagued by virus and other security ... Mainframe OSs have been far less prone ... professionally managed back-end machines versus desktop ...
    (comp.lang.cobol)
  • Re: what is reset account?
    ... No I don't think that policy value was available in Windows 2000. ... I believe the policy was added in K3, but the reg value works in 2K as well as NT. ... windows 2000 server security options. ... deployed based on computer account. ...
    (microsoft.public.win2000.active_directory)