Ask the Expert

Can we start with local GPOs and move to AD policies after our Win2k domain upgrade?

Our organization has an NT domain with 3000 computers, 70% of which are Windows 2000. The domain will be upgraded soon to Windows 2000 with Active Directory implemented, but the timing for this implementation is uncertain. One of the major projects for 2003 is the lock down of the workstations. Should we wait for AD to be implemented and use domain-linked group policy objects (GPOs) or can we start with local GPOs and then easily move policies to Active Directory?

Requires Free Membership to View

Editing local GPOs on 2100 computers is going to be heartbreaking. If locking down desktops is a high priority now, then I'd deploy the policy settings via login scripts and then do a proper policy implementation when you have Active Directory. The problem with login scripts is that users must be administrators in order to apply those policies. That's where tools such as Profile Maker from AutoProf come in handy. It's a relatively inexpensive tool that can read ADM (Application Data Management) files and deploy those settings via login scripts without requiring you to add users to the local administrators group. The tool is also exceptionally easy to use. I'd use something similar until you have a proper Active Directory implementation.

This was first published in February 2003

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: