Re: ftp non-anonymous help - logon locally overriden by effective policy setting at domain level

From: x y (jamescagney90210@excite.com)
Date: 05/16/02 

From: "x y" <jamescagney90210@excite.com>
Date: Thu, 16 May 2002 00:15:33 -0400

Local policy cannot take precedence over a group policy. I believe you can
save and import the local policy from that machine and make it the group
policy for the web server either by putting the web server into its own OU
or by changing the permissions on the template so that only the web server
has permissions to read the web server policy. I believe you could also
change the permissions on the relevant domain policies so that the web
server does not have permissions to read the default domain policy... then
the local policy would stay in effect. Permissions on the domain group
policies are done in the Active Directory Users and Computers MMC by
right-clicking the relevant OU.

OR, you can consider unjoining your web server from the domain, which is not
a bad idea security-wise unless you have specific authentication needs that
make this difficult.

"Jeff Briar-Hill" <jeff_briarhill_2000@yahoo.com> wrote in message
news:6d77bc9.0205151937.3fbcc683@posting.google.com...
> config: i have a two server configuration for a secure website using
> iis5 on one and ad on the other server.
>
> i would like to create an ftp site that is as secure as possible. to
> accomplish this i created a local account on the webserver per this
> instruction:
>
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechn
ol/iis/maintain/optimize/custom.asp
>
> "To simplify administration of Windows 2000 accounts used for FTP
> access,_our company created a local Windows 2000 group called FTP
> Admins. We then granted this group the right to log on locally. As we
> create new Windows 2000 accounts for nonanonymous FTP access, we add
> each user account to this group. They now have appropriate rights, and
> we can track all the FTP accounts as a single administrative entity. "
>
> problem: the domain security policy overrides the local web server
> policy for log-on locally. i have tried new group policy settings for
> the domain that don't override or define the logon locally policy,
> defining it locally and secedit /refreshpolicy... etc. all with no
> luck. does anyone know how to allow a local policy to override the
> effective setting from a domain controller?
>
> help appreciated,
>
> jeff

Relevant Pages

  • Re: xp home connectivity
    ... check the settings on local policy ... Look for policy named: "Network Access: ... Sharing and security model for local accounts". ...
    (microsoft.public.security)
  • Re: local policies for xp to apply to all users except admin
    ... Local policy applies to all accounts equally, ... If you place a Deny of Full for Adminsitrators on this ... they will be exempted from application of policy. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Local Security Policy on domain controller?
    ... A google search for "security configuration templates" turns up a fair ... Some settings require a reboot and others don't. ... >> It's so close to affecting the local policy that I probably shouldn't ... >> it will affect local security policy, ...
    (microsoft.public.win2000.security)
  • Re: local security policy in a 2003 Domain
    ... As soon as you would reinsert it back into the domain, domain policy would ... You can use group policy to give this account the proper rights. ... place the web server into that OU. ... >> When settings are disabled like that in local policy, ...
    (microsoft.public.security)
  • Re: Restrict computers user in an OU or Group can log on to
    ... If you don't want to overwrite local policy for user rights look into using the ... With over 1500 computers I don't feel like ...
    (microsoft.public.win2000.security)