Can I push out Local Security Policy Settings Remotely?

[stephenmbell]

Hello,


I have a network that I manage - it has 700 windows XP based PC's (SP2) in a total of 350 different locations.

These machines are accessible over a WAN connection from my desk - and they are not joined to any domain.

I am looking for a way to configure certain settings, specifically, the audit section in the Local Security Policy and then push these settings out to all of these machines. I have done some research but am not really sure if I have found what I am looking for. If there was a way to write a script to modify the registry or drop some files in the c:\windows\security\... folder(s)

On the surface, I know - setting the "local" security "remotely" doesn't make much sense at all - but this is a closed circuit network and the machines are not used as "traditional" desktops.

Any help or direction is greatly appreciated. Thanks in advance..

sb

 

[telcorookie]

Not that i am aware of, unless there a member of a domain.

 

[BadBigBen]

take a look at GPO's...

http://technet.microsoft.com/en-us/windowsserver/grouppolicy/default.aspx

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[stephenmbell]

Wouldn't GPO's only be applicable if my machines were a member of a domain?


Thanks for the replies
sb

 

[BadBigBen]

"If you have no domain - you need to make the changes in one of the machine's Group Policy Editor (gpedit.msc) and copy the "Group Policy" folder in system32 to all other machines manually.

source: Florian Frommherz MVP - Group Policy 2008



also take a look at:

Policies, No Domain





Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[IllogicallyLogical]

Look at using the command line tool secedit.exe to script the deployment of the security template.

- Understanding Windows Security Templates

http://www.windowsecurity.com/articles/Understanding-Windows-Security-Templates.html

- Creating a Custom Security Template Using the MMC Snap-in

http://msdn.microsoft.com/en-us/library/ms933182(WinEmbedded.5).aspx

- Secedit

http://technet.microsoft.com/en-us/library/bb490997.aspx

- Baselining with Security Templates

http://www.windowsecurity.com/articles/Baselining-Security-Templates.html

If you have more than just a few computers that you need to configure, but you don’t have access or control over the GPOs in Active Directory, you can deploy security templates using a command line option. The command line tool is named SECEDIT.EXE and is the command line version of the SCA. Almost anything that you can do in the SCA you can also do with the SECEDIT tool.

SECEDIT can either be run on each computer, or it can be scripted to run automatically on many computers. The command that would deploy a security template on a computer is:

SECEDIT /configure /db db1.sdb cfg sectemplatename.inf /log logname.log

This will configure the local computer using a database name of db1.sdb, a security template name of sectplatename.inf, and a log file of logname.log. These names can be anything that you want. If you are scripting the command, you will want to place the security template file on a network share and use a network path to point the computer to the file.

Joey
CCNA, MCSA 2003, MCP, A+, Network+, Wireless#