System policies

[wahooguy]

I am setting up a 4 node NT network, 1 NT Server 4.0 SP5 and 3 NT WS 4.0 SP5. We will have 3 different types of users, each needing varying degrees of functionality. 1 type will be completely locked down (ie no run command, no registry editor, no control panel), 1 with middle of the road priviledges (can change display but no registry editor), 1 poweruser (almost admin). I want to setup policies using system policy editor on the server for centralized admin.<br>
<br>
I have all the policies set on the server and when I logon as each type of user, I get the desired settings. However, when I logon from the workstations, I have absolutely no policies in force. The ntconfig.pol file is in the netlogon share (c:\winnt\system32\repl\import\scripts). I am not running policy editor on the workstations.<br>
<br>
Any ideas would be greatly appreciated.

 

[MasterRacker]

Have you verified through Network Neighborhood from one of the workstations that the netlogon share is actually originating from that folder? (A collegue didn't set up ther server and change the default location?) This would also verify that various user accounts can read the share from the workstation.<br>
<br>
Also, are the machines members of the domain?

 

[wahooguy]

FIGURED IT OUT!! Sorry for the excitement, but when you spend a month off and on a problem, you're happy when it falls into place.<br>
<br>
Anyway, after searching for the umpteenth time, I found reference to MS online seminar on policies and profiles. There was one slide that mentioned troubleshooting policies. The one that helped (other than the obvious check protocols, shares, domains (thanks though, MasterRacker)) was to do a registry search for UpdateMode. I had 3 occurrences: hkey_local_machine\system\controlset0001\control\update, ..\controlset0002\.., and ..\currentcontrolset\.. Once I changed those values to 1 to enable automatic update rather than manual, the policies worked like a charm.<br>
<br>
I find it odd that all 3 workstations would have this setting. Could it be because I never ran SPE on them or setup a policy directly on the machine?

 

[MasterRacker]

Update mode would one of my next suggestions. Interesting, because automatic update is supposed to be the default setting on workstation. You shouldn't need to run SPE on a workstation, it should start picking up policies from a domain controleer as soon as the machine is joined to the domain.