Managing Account/User Policies
Policies can define a specific user's settings or the settings for a group of users. The resulting
policy file contains the registry settings for all users, groups, and computers that will be using
the policy file. Separate policy files for each user, group, or computer are not necessary.
If you create a policy that will be automatically downloaded from validating domain controllers,
you should name the file
NTConfig.POL. As system administrator, you have the option of renaming the
policy file and, by modifying the Windows NT-based workstation, directing the computer to update
the policy from a manual path. You can do this by either manually changing the registry or by using
the System Policy Editor. This can even be a local path such that each machine has its own policy file,
but if a change is necessary to all machines, it must be made individually to each workstation.
When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on
the authenticating domain controller for the presence of the
NTConfig.POL file. If one exists, it is
downloaded, parsed, and then applied to the user's part of the registry.
MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally
acquire policy settings through GPOs that are defined and stored in Active Directory
itself. The key benefit of using AD GPOs is that they impose no registry
This has considerable advantage compared with the use of
NTConfig.POL (NT4) style policy updates.
In addition to user access controls that may be imposed or applied via system and/or group policies
in a manner that works in conjunction with user profiles, the user management environment under
MS Windows NT4/200x/XP allows per-domain as well as per-user account restrictions to be applied.
Common restrictions that are frequently used include:
Samba-3.0.20 does not yet implement all account controls that are common to MS Windows NT4/200x/XP.
While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password
expiry is functional today. Most of the remaining controls at this time have only stub routines
that may eventually be completed to provide actual control. Do not be misled by the fact that a
parameter can be set using the NT4 Domain User Manager or in the