RE: Moving from NT4 policy to Group Policy

You are correct. The mixed environment of Group policies and System policies
is very difficult to manage. Even after applying the registry fixes you may
still run into odd things due to left over system policy settings (these were
a mess under NT4). Things will improve as your old machines are replace with
new or clean installs.

"SchoolTech" wrote:

As it may have been noted in other posts I made, we moved from an NT4
policy environment to WS2003 at the start of this year.

One of the challenges we are facing is inconsistent application of
policies and it seems likely this is due to conflict between the NT4
policies which are permanently applied in the registry and Group Policy
which works differently.

Sometimes the later ADM files for NT4 System Policy files will write
into the same registry area as Group Policy uses i.e. Policies subtree
which can be in two different places in the registry, including HKLM and
HKCU.

For example last year with the introduction of XP SP2 with the Windows
Firewall I obtained an ADM file for NT4 System Policy that allows the
firewall settings to be configured so we could define exceptions.

Another example is WSUS, which is all documented by MS for non GPO
environments as to the values which need to be written in specific keys
for the computers to connect to the local updates server. These are
hardcoded values.

The WSUS group gave me advice that those hardcoded keys would need to be
removed before the GPO would take effect and so I applied a one time
registry patch to all machines to delete the keys and this has resulted
in successful application of the GPO to the machines.

I did not do this for the Windows Firewall settings and these are still
in most cases running the old policy based on the former NT4 system
policy rather than the settings from the GPO.

The above applies to machines that were running on the previous NT4
domain environment (actually Samba). With newly set up machines with a
clean registry we are seeing that these machines are applying GPOs
consistently with for example the Windows Firewall GPO settings being
applied.

I am presuming that it will be necessary to remove all the hardcoded
Policies subkeys and values using a one-time patch and that this course
of action will allow GPOs to propagate correctly to machines so that we
have the advantage of being able to use the GPO environment across our
network in the future.


.

Relevant Pages

  • Re: User Policies
    ... Specifically, I am looking for a very aggressive group policy which a) doesn't alllow software installation or removal b) doesn't allow user to view registries c) doesn't allow user to view network configuration, etc... ... There are sample configuration out there but I doubt there's a sample GPO that does exactly what you're trying to do. ... For b) You can use Sofware Restriction Policies to prevent regedit and regedt32 from running, but I doubt you'll catch all kinds of registry browsers. ...
    (microsoft.public.windows.group_policy)
  • Updating Local Group Policies by modifying the registry
    ... >GPO to deny the "Apply Group Policy" for admins? ... >>I would like to apply local group policies by modifying ... >>on the PC when a user logs in. ... >>To test this I made a backup of the registry and then ...
    (microsoft.public.win2000.security)
  • Updating Local Group Policies by modifying the registry
    ... GPO to deny the "Apply Group Policy" for admins? ... >I would like to apply local group policies by modifying ... >on the PC when a user logs in. ... >To test this I made a backup of the registry and then ...
    (microsoft.public.win2000.security)
  • Re: Local policy, IE and SP2...
    ... I must mention here that I rarely use GPEdit and almost always I change the Explorer or System policies through registry. ... The same I did for those tests I mentioned for SP2. ... this is true - those policies will not allow you to lock user accounts from launching applications from hidden drives. ...
    (microsoft.public.windowsxp.embedded)
  • Re: What program is used to write events to the event log??????
    ... I believe that the event logging functionality is implemented as ... > issue....whenever there is an exe being started it normally writes this ... a few days ago I posted a question about wether these policies could ... > search function it can only be found in the registry at the three above ...
    (microsoft.public.windowsxp.security_admin)