Re: Group Policy Defaults

From: Roger Abell (abell@asu.edu)
Date: 03/28/03 

From: "Roger Abell" <abell@asu.edu>
Date: Fri, 28 Mar 2003 02:49:39 -0700

Thanks Nick - you had me wondering and retesting :-) 

-- 
Roger 
"Nick Finco [MS]" <nfinco@online.microsoft.com> wrote in message news:#Eikc2K9CHA.972@TK2MSFTNGP12.phx.gbl...
> Ah, sorry for the confusion.  I see what you are saying now and you are
> correct.  Without the /areas switch specifying that secedit only configures
> securitypolicy and user_rights (to mirror the snapin's behavior), it would
> reapply the entire template.  The snapin does leave out the group_mgmt,
> regkeys, filestore, and services sections.
> 
> N
> 
> -- 
> This posting is provided "AS IS" with no warranties, and confers no rights.
> 
> 
> "Roger Abell [MVP]" <mvpNOSPAM@asu.edu> wrote in message
> news:OXHt#uB9CHA.2044@TK2MSFTNGP10.phx.gbl...
> Thanks Nick,
> 
> Is this some sort of special handling for setup security.inf ?
> Set me a little straighter and shorten my experiments would you ?
> 
> I do understand what you are saying about there no longer being
> a lgpo, but I am not following how this changes the differences
> between an import of security policy out of a template as compared
> to a secedit /cfg without use of /areas
> 
> If I define a template and set a service startup and its security and
> a filesystem object's ACL, analyze against this just for fun and see
> what it would change, and then import this neither setting in the
> template is applied (as expected).  However, if I use secedit /cfg
> and let it do all of the template the NTFS and service get adjusted.
> 
> -- 
> Roger
> 
> "Nick Finco [MS]" <nfinco@online.microsoft.com> wrote in message
> news:#SGiagA9CHA.2596@TK2MSFTNGP11.phx.gbl...
> > You are correct for Win2k.
> >
> > On WinXP and WS2003, the Local Group Policy Object for security settings
> was
> > removed.  The settings displayed in the Local Security Settings snapin now
> > edit the current settings on the system, not a LGPO that is applied at
> every
> > policy refresh.  Thus, using secedit /configure is the same as using the
> > import functionality of the snapin.
> >
> > N
> >
> > -- 
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> >
> >
> > "Roger Abell [MVP]" <mvpNOSPAM@asu.edu> wrote in message
> > news:ekHzoS58CHA.2052@TK2MSFTNGP11.phx.gbl...
> > Note that as given these two have different effects.
> > The first will reset the security policies, the second will
> > also reapply settings for filesystem, registry, services, etc.
> >
> > For what the poster indicates, the first option seems the
> > way to go.
> >
> > -- 
> > Roger
> >
> > "Nick Finco [MS]" <nfinco@online.microsoft.com> wrote in message
> > news:#3GuLzv8CHA.1600@TK2MSFTNGP10.phx.gbl...
> > > Open the Local Security Policy, right click on Security Settings, and
> > choose
> > > Import Policy.  Navigate to your windows directory, then 'security',
> then
> > > 'templates'.  Double click on 'Setup Security.inf' to configure that to
> > your
> > > system.
> > >
> > > Another way you can do this is to open a command prompt and execute
> > 'secedit
> > > /configure /cfg "%windir%\security\templates\setup security.inf" /db
> > > "%windir%\security\database\ss.sdb"'.
> > >
> > > This will get you back to your system defaults.
> > >
> > > N
> > >
> > > -- 
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > >
> > >
> > > "Matt" <mattw@lifelinestechnology.com> wrote in message
> > > news:37f201c2f2fb$1f2867d0$a401280a@phx.gbl...
> > > > Whats the quickest way to reset group policy to its
> > > > default settings on an xp pro system, locally.  There isnt
> > > > a domain policy on this system yet. I was playing around
> > > > with local policy settings and somehow locked admin and
> > > > every user out.  I finally got back in as admin, but cant
> > > > get the policy to reset to its default settings. Thanks in
> > > > advance.
> > > > Matt
> > >
> > >
> >
> >
> 
>

Relevant Pages

  • Re: security template file import
    ... i sort a little more comfortable going through the reimport of the security ... in here is a single file - GPTTMPL.INF that lists the securtiy settings (and ... when the DC as a group policy client downloads the GPO it sticks the ... > template outside of the GPO which you edit to contain all the security ...
    (microsoft.public.win2000.security)
  • Re: User Rights in Setup Security Template
    ... > template in order to change some password policies. ... > Group Policy mmc, or else, in Security Configuration and Analysis ... > settings is impacting you. ... > templates and analyze your ...
    (microsoft.public.windowsxp.security_admin)
  • Re: USB disable policy template problem
    ... Uncheck the Only show policy settings that can be fully managed checkbox ... To add administrative template you need to select Action|Add/Remove ... serious treat for corporate security, the last pair is rarely used ... We decided to purchase USB & Ports ...
    (microsoft.public.windows.server.general)
  • RE: local security policy
    ... Yes I am using the security config and analysis snap-in to create the ... included in my exported template. ... Right now the only way that I know how to get those settings applied to ... Configuration and Analysis snap-in? ...
    (Focus-Microsoft)
  • Re: MICROSOFT_AUTHENTICATION_PACKAGE
    ... Is the security option "additional restrictions for anonymous connections" - ... changes to the Local Security Policy of a domain controller, ... then examine the settings in the Local Security ... domain machine if you changed domain security policy. ...
    (microsoft.public.win2000.security)