NT4 Policy Applied to Win2k Pro machines, problems and such

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

An admin at my workplace put a policy(ntconfig.pol) out on our domain controller. This policy had 3 components, a specific user with lots of restrictions, default user, and default computer. The default user and computer were unmodified from the blank policy, only the specific user was changed. By this I mean, the admin opened poledit, added .adm templates, createda new policy which by default has default user and default computer, then added and restricted his specific user. Now I'm seeing users who have lost the all users start menu items and can no longer right click on Start Menu and get the all users menu option, its not there. These users are local admin on machines in question.
 
Hi there

From what you've said, this should not be happening. I imagine that he did
actually put some restrictions on Default User. When I used NT4 system
policies, the first thing I always did was to delete the Default User and
Default Computer items.

Anyway, to debug this, you need the help of regedt32.

Take a copy of the ntconfig.pol file and run regedt32. Select the
HKEY_USERS window and go to File | Load Hive. Open the ntconfig.pol file
and when asked what name you want to give it, call it "ntconfig" or some
other name of your choice.

You can then use your favourite registry editing tool (RegEdit or RegEdt32)
to look at the contents of the file. I don't have a policy to hand, but it
should be fairly easy for you to work out what's in the policy. If you
follow the Default User branch down and find stuff in there, you can be
fairly sure of what's going on. You may see complete branches without any
registry values on them. That doesn't mean that any policies are
configured.

To unload the hive, go back to the "ntconfig" item and choose File | Unload
hive.

The bad news is that NT4 system policies "tattoo" themselves onto the
registry. Simply deleting the ntconfig.pol file won't cause any damage
that's been done to users' profiles to be undone.

Anyway, hope this helps.

Oli




Benhanson@borough said:
An admin at my workplace put a policy(ntconfig.pol) out on our domain
Click to expand...
controller. This policy had 3 components, a specific user with lots of
restrictions, default user, and default computer. The default user and
computer were unmodified from the blank policy, only the specific user was
changed. By this I mean, the admin opened poledit, added .adm templates,
createda new policy which by default has default user and default computer,
then added and restricted his specific user. Now I'm seeing users who have
lost the all users start menu items and can no longer right click on Start
Menu and get the all users menu option, its not there. These users are
local admin on machines in question.
 
Not sure, but I think I got a way out. The same type of thing happened to
us when I unwittingly created a new policy and didn't check out all the
"default user" and "default computer" settings. (or perhaps I "unchecked"
all the settings thinking I was doing myself a favor being my first time
messing with system policies...) For instance, I didn't check out the
"shared start menu" items thus all users did not have a common shared "all
users start menu." I left them all unchecked or maybe I unchecked them. I
think I unwittingly changed the "custom items" also.... Then the users
started logging in and they had no shared start menu like the all user
profile was supposed to share out, so multiple start menus started popping
up at the root of "winnt".. I'd delete them and they'd recreate themselves.

I fixed it by looking at a known good policy and then fixing my messed up
policy, checking the proper boxes for the default user and or default
computer, carefully replacing the shared folders and custom folder items in
there and things were happy again. No need to delve into reg hacks at all
once the users logged back in and got the new policy applied.

Dave Niemeyer
 
Good stuff.

The method I described is a very good way to find out exactly what is in a
system policy and who's going to be affected by it.

Regards

Oli
 
Back
Top