1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�24.�System and Account Policies</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.66.1"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part�III.�Advanced Configuration"><link rel="prev" href="AdvancedNetworkManagement.html" title="Chapter�23.�Advanced Network Management"><link rel="next" href="ProfileMgmt.html" title="Chapter�25.�Desktop Profile Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�24.�System and Account Policies</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Advanced Configuration</th><td width="20%" align="right">�<a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter�24.�System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="PolicyMgmt.html#id2599003">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2599084">Creating and Managing System Policies</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2599199">Windows 9x/ME Policies</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2599294">Windows NT4-Style Policy Files</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2599418">MS Windows 200x/XP Professional Policies</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id2599666">Managing Account/User Policies</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2599805">Management Tools</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2599817">Samba Editreg Tool-set</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2599899">Windows NT4/200x</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id2599921">Samba PDC</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id2599958">System Startup and Logon Processing Overview</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id2600084">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id2600095">Policy Does Not Work</a></span></dt></dl></dd></dl></div><p> 2This chapter summarizes the current state of knowledge derived from personal 3practice and knowledge from Samba mailing list subscribers. Before reproduction 4of posted information, every effort has been made to validate the information given. 5Where additional information was uncovered through this validation it is provided 6also. 7</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599003"></a>Features and Benefits</h2></div></div></div><p> 8When MS Windows NT 3.5 was introduced, the hot new topic was the ability to implement 9Group Policies for users and groups. Then along came MS Windows NT4 and a few sites 10started to adopt this capability. How do we know that? By the number of “<span class="quote"><span class="emphasis"><em>boo-boos</em></span></span>” 11(or mistakes) administrators made and then requested help to resolve. 12</p><p> 13<a class="indexterm" name="id2599024"></a> 14<a class="indexterm" name="id2599031"></a> 15<a class="indexterm" name="id2599038"></a> 16By the time that MS Windows 2000 and Active Directory was released, administrators 17got the message: Group Policies are a good thing! They can help reduce administrative 18costs and actually make happier users. But adoption of the true 19potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users 20and machines were picked up on rather slowly. This was obvious from the Samba 21mailing list as in 2000 and 2001 when there were few postings regarding GPOs and 22how to replicate them in a Samba environment. 23</p><p> 24Judging by the traffic volume since mid 2002, GPOs have become a standard part of 25the deployment in many sites. This chapter reviews techniques and methods that can 26be used to exploit opportunities for automation of control over user desktops and 27network client workstations. 28</p><p> 29A tool new to Samba the <span><b class="command">editreg</b></span> tool 30 may become an important part of the future Samba administrators' 31arsenal is described in this document. 32</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599084"></a>Creating and Managing System Policies</h2></div></div></div><p> 33Under MS Windows platforms, particularly those following the release of MS Windows 34NT4 and MS Windows 95, it is possible to create a type of file that would be placed 35in the NETLOGON share of a Domain Controller. As the client logs onto the network, 36this file is read and the contents initiate changes to the registry of the client 37machine. This file allows changes to be made to those parts of the registry that 38affect users, groups of users, or machines. 39</p><p> 40<a class="indexterm" name="id2599103"></a> 41For MS Windows 9x/ME, this file must be called <tt class="filename">Config.POL</tt> and may 42be generated using a tool called <tt class="filename">poledit.exe</tt>, better known as the 43Policy Editor. The policy editor was provided on the Windows 98 installation CD, but 44disappeared again with the introduction of MS Windows Me (Millennium Edition). From 45comments of MS Windows network administrators, it would appear that this tool became 46a part of the MS Windows Me Resource Kit. 47</p><p> 48<a class="indexterm" name="id2599132"></a> 49MS Windows NT4 Server products include the <span class="emphasis"><em>System Policy Editor</em></span> 50under <span class="guimenu">Start -> Programs -> Administrative Tools</span>. 51For MS Windows NT4 and later clients, this file must be called <tt class="filename">NTConfig.POL</tt>. 52</p><p> 53New with the introduction of MS Windows 2000 was the Microsoft Management Console 54or MMC. This tool is the new wave in the ever-changing landscape of Microsoft 55methods for management of network access and security. Every new Microsoft product 56or technology seems to make the old rules obsolete and introduces newer and more 57complex tools and methods. To Microsoft's credit, the MMC does appear to 58be a step forward, but improved functionality comes at a great price. 59</p><p> 60Before embarking on the configuration of network and system policies, it is highly 61advisable to read the documentation available from Microsoft's Web site regarding 62<a href="http://www.microsoft.com/ntserver/techresources/management/prof_policies.asp" target="_top"> 63Implementing Profiles and Policies in Windows NT 4.0</a> available from Microsoft. 64There are a large number of documents in addition to this old one that should also 65be read and understood. Try searching on the Microsoft Web site for “<span class="quote"><span class="emphasis"><em>Group Policies</em></span></span>”. 66</p><p> 67What follows is a brief discussion with some helpful notes. The information provided 68here is incomplete you are warned. 69</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599199"></a>Windows 9x/ME Policies</h3></div></div></div><p> 70 You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/ME. 71 It can be found on the original full product Windows 98 installation CD under 72 <tt class="filename">tools/reskit/netadmin/poledit</tt>. Install this using the 73 Add/Remove Programs facility and then click on <span class="guiicon">Have Disk</span>. 74 </p><p> 75<a class="indexterm" name="id2599226"></a> 76 Use the Group Policy Editor to create a policy file that specifies the location of 77 user profiles and/or <tt class="filename">My Documents</tt>, and so on. Then save these 78 settings in a file called <tt class="filename">Config.POL</tt> that needs to be placed in the 79 root of the <i class="parameter"><tt>[NETLOGON]</tt></i> share. If Windows 98 is configured to log onto 80 the Samba Domain, it will automatically read this file and update the Windows 9x/Me registry 81 of the machine as it logs on. 82 </p><p> 83 Further details are covered in the Windows 98 Resource Kit documentation. 84 </p><p> 85 If you do not take the correct steps, then every so often Windows 9x/ME will check the 86 integrity of the registry and restore its settings from the back-up 87 copy of the registry it stores on each Windows 9x/ME machine. So, you will 88 occasionally notice things changing back to the original settings. 89 </p><p> 90 Install the group policy handler for Windows 9x/Me to pick up Group Policies. Look on the 91 Windows 98 CDROM in <tt class="filename">\tools\reskit\netadmin\poledit</tt>. 92 Install group policies on a Windows 9x/Me client by double-clicking on 93 <tt class="filename">grouppol.inf</tt>. Log off and on again a couple of times and see 94 if Windows 98 picks up Group Policies. Unfortunately, this needs to be done on every 95 Windows 9x/Me machine that uses Group Policies. 96 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599294"></a>Windows NT4-Style Policy Files</h3></div></div></div><p> 97 To create or edit <tt class="filename">ntconfig.pol</tt> you must use the NT Server 98 Policy Editor, <span><b class="command">poledit.exe</b></span>, which is included with NT4 Server 99 but not with NT Workstation. There is a Policy Editor on an NT4 100 Workstation but it is not suitable for creating domain policies. 101 Furthermore, although the Windows 95 Policy Editor can be installed on an NT4 102 Workstation/Server, it will not work with NT clients. However, the files from 103 the NT Server will run happily enough on an NT4 Workstation. 104 </p><p> 105 You need <tt class="filename">poledit.exe</tt>, <tt class="filename">common.adm</tt> and <tt class="filename">winnt.adm</tt>. 106 It is convenient to put the two <tt class="filename">*.adm</tt> files in the <tt class="filename">c:\winnt\inf</tt> 107 directory, which is where the binary will look for them unless told otherwise. This 108 directory is normally “<span class="quote"><span class="emphasis"><em>hidden.</em></span></span>” 109 </p><p> 110 The Windows NT policy editor is also included with the Service Pack 3 (and 111 later) for Windows NT 4.0. Extract the files using <span><b class="command">servicepackname /x</b></span>, 112 that's <span><b class="command">Nt4sp6ai.exe /x</b></span> for service pack 6a. The Policy Editor, 113 <span><b class="command">poledit.exe</b></span>, and the associated template files (*.adm) should 114 be extracted as well. It is also possible to downloaded the policy template 115 files for Office97 and get a copy of the Policy Editor. Another possible 116 location is with the Zero Administration Kit available for download from Microsoft. 117 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599392"></a>Registry Spoiling</h4></div></div></div><p> 118 With NT4-style registry-based policy changes, a large number of settings are not 119 automatically reversed as the user logs off. The settings that were in the 120 <tt class="filename">NTConfig.POL</tt> file were applied to the client machine registry and apply to the 121 hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known 122 as tattooing. It can have serious consequences downstream and the administrator must 123 be extremely careful not to lock out the ability to manage the machine at a later date. 124 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599418"></a>MS Windows 200x/XP Professional Policies</h3></div></div></div><p> 125 Windows NT4 system policies allow the setting of registry parameters specific to 126 users, groups and computers (client workstations) that are members of the NT4-style 127 domain. Such policy files will work with MS Windows 200x/XP clients also. 128 </p><p> 129 New to MS Windows 2000, Microsoft recently introduced a style of group policy that confers 130 a superset of capabilities compared with NT4-style policies. Obviously, the tool used 131 to create them is different, and the mechanism for implementing them is much improved. 132 </p><p> 133<a class="indexterm" name="id2599442"></a> 134 The older NT4-style registry-based policies are known as <span class="emphasis"><em>Administrative Templates</em></span> 135 in MS Windows 2000/XP Group Policy Objects (GPOs). The latter includes the ability to set various security 136 configurations, enforce Internet Explorer browser settings, change and redirect aspects of the 137 users desktop (including the location of <tt class="filename">My Documents</tt> files (directory), as 138 well as intrinsics of where menu items will appear in the Start menu). An additional new 139 feature is the ability to make available particular software Windows applications to particular 140 users and/or groups. 141 </p><p> 142 Remember, NT4 policy files are named <tt class="filename">NTConfig.POL</tt> and are stored in the root 143 of the NETLOGON share on the Domain Controllers. A Windows NT4 user enters a username, password 144 and selects the domain name to which the logon will attempt to take place. During the logon process, 145 the client machine reads the <tt class="filename">NTConfig.POL</tt> file from the NETLOGON share on 146 the authenticating server and modifies the local registry values according to the settings in this file. 147 </p><p> 148 Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of 149 a Windows 200x policy file is stored in the Active Directory itself and the other part is stored 150 in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active 151 Directory Domain Controllers. The part that is stored in the Active Directory itself is called the 152 Group Policy Container (GPC), and the part that is stored in the replicated share called SYSVOL is 153 known as the Group Policy Template (GPT). 154 </p><p> 155 With NT4 clients, the policy file is read and executed only as each user logs onto the network. 156 MS Windows 200x policies are much more complex GPOs are processed and applied at client machine 157 startup (machine specific part) and when the user logs onto the network, the user-specific part 158 is applied. In MS Windows 200x-style policy management, each machine and/or user may be subject 159 to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows 160 the administrator to also set filters over the policy settings. No such equivalent capability 161 exists with NT4-style policy files. 162 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599520"></a>Administration of Windows 200x/XP Policies</h4></div></div></div><p> 163<a class="indexterm" name="id2599529"></a> 164<a class="indexterm" name="id2599535"></a> 165 Instead of using the tool called <span class="application">The System Policy Editor</span>, commonly called Poledit (from the 166 executable name <span><b class="command">poledit.exe</b></span>), <span class="acronym">GPOs</span> are created and managed using a 167 <span class="application">Microsoft Management Console</span> <span class="acronym">(MMC)</span> snap-in as follows:</p><div class="procedure"><ol type="1"><li><p> 168 Go to the Windows 200x/XP menu <span class="guimenu">Start->Programs->Administrative Tools</span> 169 and select the MMC snap-in called <span class="guimenuitem">Active Directory Users and Computers</span> 170 </p></li><li><p> 171 Select the domain or organizational unit (OU) that you wish to manage, then right-click 172 to open the context menu for that object, and select the <span class="guibutton">Properties</span>. 173 </p></li><li><p> 174 Left-click on the <span class="guilabel">Group Policy</span> tab, then 175 left-click on the New tab. Type a name 176 for the new policy you will create. 177 </p></li><li><p> 178 Left-click on the <span class="guilabel">Edit</span> tab to commence the steps needed to create the GPO. 179 </p></li></ol></div><p> 180 All policy configuration options are controlled through the use of policy administrative 181 templates. These files have an .adm extension, both in NT4 as well as in Windows 200x/XP. 182 Beware, however, the .adm files are not interchangeable across NT4 and Windows 200x. 183 The latter introduces many new features as well as extended definition capabilities. It is 184 well beyond the scope of this documentation to explain how to program .adm files; for that 185 the administrator is referred to the Microsoft Windows Resource Kit for your particular 186 version of MS Windows. 187 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 188 The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used 189 to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you 190 use this powerful tool. Please refer to the resource kit manuals for specific usage information. 191 </p></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599666"></a>Managing Account/User Policies</h2></div></div></div><p> 192Policies can define a specific user's settings or the settings for a group of users. The resulting 193policy file contains the registry settings for all users, groups, and computers that will be using 194the policy file. Separate policy files for each user, group, or computer are not necessary. 195</p><p> 196<a class="indexterm" name="id2599682"></a> 197If you create a policy that will be automatically downloaded from validating Domain Controllers, 198you should name the file <tt class="filename">NTConfig.POL</tt>. As system administrator, you have the option of renaming the 199policy file and, by modifying the Windows NT-based workstation, directing the computer to update 200the policy from a manual path. You can do this by either manually changing the registry or by using 201the System Policy Editor. This can even be a local path such that each machine has its own policy file, 202but if a change is necessary to all machines, it must be made individually to each workstation. 203</p><p> 204When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on 205the authenticating domain controller for the presence of the NTConfig.POL file. If one exists it is 206downloaded, parsed and then applied to the user's part of the registry. 207</p><p> 208<a class="indexterm" name="id2599716"></a> 209MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally 210acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory 211itself. The key benefit of using AS GPOs is that they impose no registry <span class="emphasis"><em>spoiling</em></span> effect. 212This has considerable advantage compared with the use of <tt class="filename">NTConfig.POL</tt> (NT4) style policy updates. 213</p><p> 214In addition to user access controls that may be imposed or applied via system and/or group policies 215in a manner that works in conjunction with user profiles, the user management environment under 216MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. 217Common restrictions that are frequently used include: 218</p><p> 219<a class="indexterm" name="id2599752"></a> 220</p><div class="itemizedlist"><ul type="disc"><li><p>Logon hours</p></li><li><p>Password aging</p></li><li><p>Permitted logon from certain machines only</p></li><li><p>Account type (local or global)</p></li><li><p>User rights</p></li></ul></div><p> 221</p><p> 222Samba-3.0.0 does not yet implement all account controls that are common to MS Windows NT4/200x/XP. 223While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password 224expiry is functional today. Most of the remaining controls at this time have only stub routines 225that may eventually be completed to provide actual control. Do not be misled by the fact that a 226parameter can be set using the NT4 Domain User Manager or in the <tt class="filename">NTConfig.POL</tt>. 227</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599805"></a>Management Tools</h2></div></div></div><p> 228Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools. 229The following sections describe a few key tools that will help you to create a low maintenance user 230environment. 231</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599817"></a>Samba Editreg Tool-set</h3></div></div></div><p> 232<a class="indexterm" name="id2599825"></a> 233<a class="indexterm" name="id2599832"></a> 234<a class="indexterm" name="id2599839"></a> 235 A new tool called <span><b class="command">editreg</b></span> is under development. This tool can be used 236 to edit registry files (called <tt class="filename">NTUser.DAT</tt>) that are stored in user 237 and group profiles. <tt class="filename">NTConfig.POL</tt> files have the same structure as the 238 <tt class="filename">NTUser.DAT</tt> file and can be edited using this tool. <span><b class="command">editreg</b></span> 239 is being built with the intent to enable <tt class="filename">NTConfig.POL</tt> files to be saved in text format and to 240 permit the building of new <tt class="filename">NTConfig.POL</tt> files with extended capabilities. It is proving difficult 241 to realize this capability, so do not be surprised if this feature does not materialize. Formal 242 capabilities will be announced at the time that this tool is released for production use. 243 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599899"></a>Windows NT4/200x</h3></div></div></div><p> 244 The tools that may be used to configure these types of controls from the MS Windows environment are: 245 the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe). 246 Under MS Windows 200x/XP, this is done using the Microsoft Management Console (MMC) with appropriate 247 “<span class="quote"><span class="emphasis"><em>snap-ins,</em></span></span>” the registry editor, and potentially also the NT4 System and Group Policy Editor. 248 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599921"></a>Samba PDC</h3></div></div></div><p> 249 With a Samba Domain Controller, the new tools for managing user account and policy information include: 250 <span><b class="command">smbpasswd</b></span>, <span><b class="command">pdbedit</b></span>, <span><b class="command">net</b></span>, <span><b class="command">rpcclient</b></span>. 251 The administrator should read the man pages for these tools and become familiar with their use. 252 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599958"></a>System Startup and Logon Processing Overview</h2></div></div></div><p> 253The following attempts to document the order of processing the system and user policies following a system 254reboot and as part of the user logon: 255</p><div class="orderedlist"><ol type="1"><li><p> 256 Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming 257 Convention Provider (MUP) start. 258 </p></li><li><p> 259 Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded 260 and applied. The list may include GPOs that: 261</p><div class="itemizedlist"><ul type="disc"><li><p>Apply to the location of machines in a Directory.</p></li><li><p>Apply only when settings have changed.</p></li><li><p>Depend on configuration of the scope of applicability: local, 262 site, domain, organizational unit, and so on.</p></li></ul></div><p> 263 No desktop user interface is presented until the above have been processed. 264 </p></li><li><p> 265 Execution of start-up scripts (hidden and synchronous by default). 266 </p></li><li><p> 267 A keyboard action to effect start of logon (Ctrl-Alt-Del). 268 </p></li><li><p> 269 User credentials are validated, user profile is loaded (depends on policy settings). 270 </p></li><li><p> 271 An ordered list of user GPOs is obtained. The list contents depends on what is configured in respect of: 272 273</p><div class="itemizedlist"><ul type="disc"><li><p>Is the user a Domain Member, thus subject to particular policies?</p></li><li><p>Loopback enablement, and the state of the loopback policy (Merge or Replace).</p></li><li><p>Location of the Active Directory itself.</p></li><li><p>Has the list of GPOs changed? No processing is needed if not changed.</p></li></ul></div><p> 274 </p></li><li><p> 275 User Policies are applied from Active Directory. Note: There are several types. 276 </p></li><li><p> 277 Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on Group 278 Policy objects (hidden and executed synchronously). NT4-style logon scripts are then run in a normal 279 window. 280 </p></li><li><p> 281 The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4 282 Domain), machine (system) policies are applied at start-up; user policies are applied at logon. 283 </p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2600084"></a>Common Errors</h2></div></div></div><p> 284Policy-related problems can be quite difficult to diagnose and even more difficult to rectify. The following 285collection demonstrates only basic issues. 286</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600095"></a>Policy Does Not Work</h3></div></div></div><p> 287“<span class="quote"><span class="emphasis"><em>We have created the <tt class="filename">Config.POL</tt> file and put it in the <span class="emphasis"><em>NETLOGON</em></span> share. 288It has made no difference to our Win XP Pro machines, they just do not see it. It worked fine with Win 98 but does not 289work any longer since we upgraded to Win XP Pro. Any hints?</em></span></span>” 290</p><p> 291Policy files are not portable between Windows 9x/Me and MS Windows NT4/200x/XP-based platforms. You need to 292use the NT4 Group Policy Editor to create a file called <tt class="filename">NTConfig.POL</tt> so it is in the 293correct format for your MS Windows XP Pro clients. 294</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�23.�Advanced Network Management�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�25.�Desktop Profile Management</td></tr></table></div></body></html> 295