Manage Learn to apply best practices and optimize your operations.

Can we start with local GPOs and move to AD policies after our Win2k domain upgrade?

Our organization has an NT domain with 3000 computers, 70% of which are Windows 2000. The domain will be upgraded soon to Windows 2000 with Active Directory implemented, but the timing for this implementation is uncertain. One of the major projects for 2003 is the lock down of the workstations. Should we wait for AD to be implemented and use domain-linked group policy objects (GPOs) or can we start with local GPOs and then easily move policies to Active Directory?
Editing local GPOs on 2100 computers is going to be heartbreaking. If locking down desktops is a high priority now, then I'd deploy the policy settings via login scripts and then do a proper policy implementation when you have Active Directory. The problem with login scripts is that users must be administrators in order to apply those policies. That's where tools such as Profile Maker from AutoProf come in handy. It's a relatively inexpensive tool that can read ADM (Application Data Management) files and deploy those settings via login scripts without requiring you to add users to the local administrators group. The tool is also exceptionally easy to use. I'd use something similar until you have a proper Active Directory implementation.

Dig Deeper on Windows systems and network management

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.