Local User Policies

  • Thread starter Thread starter Mrich
  • Start date Start date
M

Mrich

How can I view all policies applied for a group ? Also is there a way to
"reset" the group to its default.
My problem is that my user group can not do certain things as they used to.
I know I played with some settings but forgot which.
Example, some secure web pages can not be viewed. Or trying to print a
document with a picture brings up a blank page and nothing prints.
So if I could somehow make my "user" group back to the default as it was on
installing W2K, that would be wonderful. In other words, get
rid of all policies that I have set.
Thanks in advance
 
Hi Mrich,

If I understand well, you have local policies.
Local policies are applied to all users on the machine, not applied to a
group of users.

To revert state, you should set policies that you have configured before to
not configured.

Regards,
 
VMM said:
Hi Mrich,

If I understand well, you have local policies.
Local policies are applied to all users on the machine, not applied to a
group of users.

To revert state, you should set policies that you have configured before
to
not configured.
Click to expand...

I think you have to force them to the "value" you want them to be first,
wait for it all to replicate, then set them in GPO to "not configured".
Setting them to "not configured" only makes GPO "get go" of the control, but
doesn't return the settings back to the original state before they were ever
touched. There may also be a variance in the behavor for different things.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not those of
my employer or anyone else associated with me.
 
Actually, this depends on whether or not you have altered the baseline
policies on the client computers. You should be able to either remove all
GPOs from the computer/user containers or reset all the settings in the
GPO(s) to all "Not Configured" and a reboot of the computer should let the
baseline policies in the local computer's configuration load.

If the baseline policies and security settings on the client PC are
unaltered you should now have a clean baseline to start re-configuring GPOs
from.

You'll probably want to remove user profiles from the computer before
rebooting as well so you don't get any leftovers from the cached profiles
potentially corrupting your results.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Phillip Windell said:
VMM said:
Hi Mrich,

If I understand well, you have local policies.
Local policies are applied to all users on the machine, not applied to a
group of users.

To revert state, you should set policies that you have configured before
to
not configured.
Click to expand...

I think you have to force them to the "value" you want them to be first,
wait for it all to replicate, then set them in GPO to "not configured".
Setting them to "not configured" only makes GPO "get go" of the control,
but doesn't return the settings back to the original state before they
were ever touched. There may also be a variance in the behavor for
different things.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not those of
my employer or anyone else associated with me.
Click to expand...
 
Sounds good.
I knew there was a "catch" in there somewhere when I saw the previous post,
but wasn't sure of the details.


--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not those of
my employer or anyone else associated with me.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/prodtechnol/isa/2004/deploy/dgisaserver.mspx
-----------------------------------------------------



Richard G. Harper said:
Actually, this depends on whether or not you have altered the baseline
policies on the client computers. You should be able to either remove all
GPOs from the computer/user containers or reset all the settings in the
GPO(s) to all "Not Configured" and a reboot of the computer should let the
baseline policies in the local computer's configuration load.

If the baseline policies and security settings on the client PC are
unaltered you should now have a clean baseline to start re-configuring
GPOs from.

You'll probably want to remove user profiles from the computer before
rebooting as well so you don't get any leftovers from the cached profiles
potentially corrupting your results.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Phillip Windell said:
VMM said:
Hi Mrich,

If I understand well, you have local policies.
Local policies are applied to all users on the machine, not applied to a
group of users.

To revert state, you should set policies that you have configured before
to
not configured.
Click to expand...

I think you have to force them to the "value" you want them to be first,
wait for it all to replicate, then set them in GPO to "not configured".
Setting them to "not configured" only makes GPO "get go" of the control,
but doesn't return the settings back to the original state before they
were ever touched. There may also be a variance in the behavor for
different things.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not those
of my employer or anyone else associated with me.
Click to expand...
Click to expand...
 
Hello,
I really appreciate all the replys. I have altered the baseline policies on
this local machine and I would like to reset them.
I think I did but failed to remove the user profiles before rebooting which
was a very good suggestion.


Richard G. Harper said:
Actually, this depends on whether or not you have altered the baseline
policies on the client computers. You should be able to either remove all
GPOs from the computer/user containers or reset all the settings in the
GPO(s) to all "Not Configured" and a reboot of the computer should let the
baseline policies in the local computer's configuration load.

If the baseline policies and security settings on the client PC are
unaltered you should now have a clean baseline to start re-configuring
GPOs from.

You'll probably want to remove user profiles from the computer before
rebooting as well so you don't get any leftovers from the cached profiles
potentially corrupting your results.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Phillip Windell said:
VMM said:
Hi Mrich,

If I understand well, you have local policies.
Local policies are applied to all users on the machine, not applied to a
group of users.

To revert state, you should set policies that you have configured before
to
not configured.
Click to expand...

I think you have to force them to the "value" you want them to be first,
wait for it all to replicate, then set them in GPO to "not configured".
Setting them to "not configured" only makes GPO "get go" of the control,
but doesn't return the settings back to the original state before they
were ever touched. There may also be a variance in the behavor for
different things.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not those
of my employer or anyone else associated with me.
Click to expand...
Click to expand...
 
If you have altered the baseline policies on the PC you'll need to reset
them to their original states and remove any administrative templates you
have added (like, perhaps, the WUAU template for SUS/WSUS) before the PC
will be back at a default base.

It took a bit of digging, but I finally found a Microsoft document that
lists the default settings for Windows 2000 computers that you can use to
restore a computer to its default state:

http://www.microsoft.com/technet/security/prodtech/windows2000/win2khg/appxa.mspx

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Mrich said:
Hello,
I really appreciate all the replys. I have altered the baseline policies
on this local machine and I would like to reset them.
I think I did but failed to remove the user profiles before rebooting
which was a very good suggestion.


Richard G. Harper said:
Actually, this depends on whether or not you have altered the baseline
policies on the client computers. You should be able to either remove
all GPOs from the computer/user containers or reset all the settings in
the GPO(s) to all "Not Configured" and a reboot of the computer should
let the baseline policies in the local computer's configuration load.

If the baseline policies and security settings on the client PC are
unaltered you should now have a clean baseline to start re-configuring
GPOs from.

You'll probably want to remove user profiles from the computer before
rebooting as well so you don't get any leftovers from the cached profiles
potentially corrupting your results.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Phillip Windell said:
Hi Mrich,

If I understand well, you have local policies.
Local policies are applied to all users on the machine, not applied to
a
group of users.

To revert state, you should set policies that you have configured
before to
not configured.

I think you have to force them to the "value" you want them to be first,
wait for it all to replicate, then set them in GPO to "not configured".
Setting them to "not configured" only makes GPO "get go" of the control,
but doesn't return the settings back to the original state before they
were ever touched. There may also be a variance in the behavor for
different things.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not those
of my employer or anyone else associated with me.
Click to expand...
Click to expand...
Click to expand...
 
Sorry for the late comment and I probably missed a few things, but could
the op restore those with Secedit and the proper security.inf file?
Something like:

Secedit /configure /cfg basicwk.inf /db basicwk.sdb /overwrite

or

secedit /configure /DB basicwk.sdb /CFG
"%windir%\Security\Templates\Setup security.inf" /overwrite

http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/security/secdefs.mspx
http://technet2.microsoft.com/Windo...ed09-45a3-aa5e-cf0a64a7fb881033.mspx?mfr=true

John
 
Back
Top