Introducing XP Prof. in Windows 2000 domain with currently NT clients only

Hi, I'm looking for some good advice to handling the following
situation.

We have a small domain with say 10 NTworkstations in a very secure
evironment, so ntconfig.pol is used and is very strict. Everhting
works OK and nice the way it is configured in ntconfig.pol.

The server is Winodws 2000 based and has AD enabled but is obviously
in mixed mode, with all these NT clients. I am asked to prepare the
migration of the NT4 workstations to XP. There is an sysprep image
available from our main corporate domain, but obviously I need to tune
things when I make this XP image/workstation part of the secure
smaller Windows 2000 domain.

Could it be possible to just enter regedit and adapt the pc to look
for and use the same ntconfig.pol that the NT4 users use ?
At the moment I am pretty sure that the XP pc is not using
ntconfig.pol on the server. It it not even giving members of domain
admins admin rights on the XP. Only the local administrator had
"admin" rights. I need to fix this pretty fast.

My company has not given training for more than 4 years so I lack this
specific knowledge regarding this NT-XP migration and the effect of
policies. I know I should not use ntconfig.pol because grouppolicies
is the way to go with AD but I'm not even supposed to maintain this
small domain in future. We're just looking for the shortest, least
effort in migrating.

Any advice how to let XP use the ntconfig.pol that is already in use
on this Windows 2000 domain with NT4 clients ?

Is altering this key all I need to do ?

HK_LM\system\current controlset\control\update\updatemode=2
HK_LM\system\current
controlset\control\update\networkpath=%logonserver %\netlogon

"J. Foster" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hi, I'm looking for some good advice to handling the following
> situation.
>
> We have a small domain with say 10 NTworkstations in a very secure
> evironment, so ntconfig.pol is used and is very strict. Everhting
> works OK and nice the way it is configured in ntconfig.pol.

Don't know if you could, but I wouldn't do it anyway. Use Group Policy to
cover the policies for Win2000 and XP-Pro machines. The NT4.0 machines will
eventually diminish, I really doubt you will get more of them. So move
forwards not backwards,..keep using the ntconf.pol for the NT machine for
now,...but everything "new" gets done with Group Policy. You just rig up
with Group Policy to do "the same thing" that you are doing with the
ntconfig.pol and all the machines will act the same. The fact that some are
getting it from ntconf.pol and some are getting it from Group Policy is
irrelevant.

"Mixed-mode" only means you can have 2000/2003 Domain Controllers at the
same time as having NT4 Domain Controllers. Make all the Domain Controllers
to be 2000 or newer and there is no point in running "mixed-mode",....the
kind of Clients and Member Servers you have is irrelevant.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/pro...isaserver.mspx
-----------------------------------------------------

On Fri, 16 Dec 2005 10:10:03 -0600, "Phillip Windell" <@.> wrote:

>"J. Foster" <(E-Mail Removed)> wrote in message
>news:(E-Mail Removed).. .
>> Hi, I'm looking for some good advice to handling the following
>> situation.
>>
>> We have a small domain with say 10 NTworkstations in a very secure
>> evironment, so ntconfig.pol is used and is very strict. Everhting
>> works OK and nice the way it is configured in ntconfig.pol.
>
>Don't know if you could, but I wouldn't do it anyway. Use Group Policy to
>cover the policies for Win2000 and XP-Pro machines. The NT4.0 machines will
>eventually diminish, I really doubt you will get more of them. So move
>forwards not backwards,..keep using the ntconf.pol for the NT machine for
>now,...but everything "new" gets done with Group Policy. You just rig up
>with Group Policy to do "the same thing" that you are doing with the
>ntconfig.pol and all the machines will act the same. The fact that some are
>getting it from ntconf.pol and some are getting it from Group Policy is
>irrelevant.
>
>"Mixed-mode" only means you can have 2000/2003 Domain Controllers at the
>same time as having NT4 Domain Controllers. Make all the Domain Controllers
>to be 2000 or newer and there is no point in running "mixed-mode",....the
>kind of Clients and Member Servers you have is irrelevant.

Thanks!

Is there a kind of tool that can print all the ntconfig.pol settings
so that I can make that grouppolicy according the NT4 standards in
that domain ?

"J. Foster" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Is there a kind of tool that can print all the ntconfig.pol settings
> so that I can make that grouppolicy according the NT4 standards in
> that domain ?

I don't know. There is for the GPO's that you can download and install from
MS,..but I don't know of anything for the NTConfig.pol. It is an MMC thing
called simply "Group Policy Manager" and I suspect it will be incorperated
into the next version of Windows Server.

I don't know that it is that important. The main thing is that the new ones
with GPO do what you want,..and you should already know what you want. If
there were things in the old that you don't remember you did, then maybe it
wasn't that important and you don't need it anyway. Think if this as an
opportunity to "cleanup" old uneeded settings that you can do without. The
simpler and "cleaner" you keep things the easier it is to manage anyway.

Keep in mind that some things with GPO cannot be easily
"reversed",...disassociating the Clients from the GPO does not always remove
the changes made to the Clients and put them back to the "default". So you
should always use GPO "sparingly", only do what you really *need* to do with
it and avoid doing things with it simply because "you can".

Also avoid modifying the "default" policies (there are several). Create
"new" policies that override the Defaults,...this way you can go back to the
Defaults by unlinking the "new" policy and letting the Default take over
again. It may not put everything back,..but "something" is better than
"nothing", which is what you are left with if you modify the Default
Policies and don't know how to put them back.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

On Thu, 22 Dec 2005 10:51:29 -0600, "Phillip Windell" <@.> wrote:

>"J. Foster" <(E-Mail Removed)> wrote in message
>news:(E-Mail Removed).. .
> > Is there a kind of tool that can print all the ntconfig.pol settings
>> so that I can make that grouppolicy according the NT4 standards in
>> that domain ?
>
>I don't know. There is for the GPO's that you can download and install from
>MS,..but I don't know of anything for the NTConfig.pol. It is an MMC thing
>called simply "Group Policy Manager" and I suspect it will be incorperated
>into the next version of Windows Server.
>
>I don't know that it is that important. The main thing is that the new ones
>with GPO do what you want,..and you should already know what you want. If
>there were things in the old that you don't remember you did, then maybe it
>wasn't that important and you don't need it anyway. Think if this as an
>opportunity to "cleanup" old uneeded settings that you can do without. The
>simpler and "cleaner" you keep things the easier it is to manage anyway.
>
>Keep in mind that some things with GPO cannot be easily
>"reversed",...disassociating the Clients from the GPO does not always remove
>the changes made to the Clients and put them back to the "default". So you
>should always use GPO "sparingly", only do what you really *need* to do with
>it and avoid doing things with it simply because "you can".
>
>Also avoid modifying the "default" policies (there are several). Create
>"new" policies that override the Defaults,...this way you can go back to the
>Defaults by unlinking the "new" policy and letting the Default take over
>again. It may not put everything back,..but "something" is better than
>"nothing", which is what you are left with if you modify the Default
>Policies and don't know how to put them back.


Well, in fact I did not administer this domain, nor will I in the
future. The current sysadmin has no IT degree, and my knowledge is
dated (NT4). So, I have no knowledge of what might be in the current
ntconfig.pol. I have found a ms tool gpolmig.exe that can list and
migrate ntconfig.pol to grouppolicy. This is my best hope I think.

"J. Foster" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> future. The current sysadmin has no IT degree, and my knowledge is
> dated (NT4). So, I have no knowledge of what might be in the current
> ntconfig.pol. I have found a ms tool gpolmig.exe that can list and
> migrate ntconfig.pol to grouppolicy. This is my best hope I think.

Sounds good.

BTW - All I have is a GED. I didn't even grduate from High School,...only
went as far as the first semester of 2nd year. No degees of any kind.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

On Tue, 27 Dec 2005 12:20:25 -0600, "Phillip Windell" <@.> wrote:

>"J. Foster" <(E-Mail Removed)> wrote in message
>news:(E-Mail Removed).. .
>> future. The current sysadmin has no IT degree, and my knowledge is
>> dated (NT4). So, I have no knowledge of what might be in the current
>> ntconfig.pol. I have found a ms tool gpolmig.exe that can list and
>> migrate ntconfig.pol to grouppolicy. This is my best hope I think.
>
>Sounds good.
>
>BTW - All I have is a GED. I didn't even grduate from High School,...only
>went as far as the first semester of 2nd year. No degees of any kind.

That's great. The current sysadmin has no IT degree because it is not
her core function and certainly not her ambition nor does she like
doing that kind of work. She is head of the lab and just follows
procedures that our main IT has written out for her. They have no
funds for a real IT person, so they depend on the good-will of our
main IT. That's how strange decisions get made. ;-)
Anyway, wishing you all the best for the coming year!