Q

Can we start with local GPOs and move to AD policies after our Win2k domain upgrade?

Our organization has an NT domain with 3000 computers, 70% of which are Windows 2000. The domain will be upgraded soon to Windows 2000 with Active Directory implemented, but the timing for this implementation is uncertain. One of the major projects for 2003 is the lock down of the workstations. Should we wait for AD to be implemented and use domain-linked group policy objects (GPOs) or can we start with local GPOs and then easily move policies to Active Directory?
Editing local GPOs on 2100 computers is going to be heartbreaking. If locking down desktops is a high priority now, then I'd deploy the policy settings via login scripts and then do a proper policy implementation when you have Active Directory. The problem with login scripts is that users must be administrators in order to apply those policies. That's where tools such as Profile Maker from AutoProf come in handy. It's a relatively inexpensive tool that can read ADM (Application Data Management) files and deploy those settings via login scripts without requiring you to add users to the local administrators group. The tool is also exceptionally easy to use. I'd use something similar until you have a proper Active Directory implementation.
This was first published in February 2003

Dig deeper on Microsoft Group Policy Management

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close