Policy Primitives

The following definitions are important for a complete understanding of policies:

A policy is a permission or attribute for a particular item, action, or object. It is either enabled or disabled.
A part is a subcomponent of a policy. A policy may have zero or more parts. Policy parts may have various data types, including Boolean values, numeric values, and string values. The values of the parts apply only if the policy is enabled.
A category is a collection of similar policies.

Some policies do not need any parts. For instance, "Lock Desktop Links" could be a policy. For such a policy, it would be sufficient to say that it was either enabled or disabled. If it were enabled, the user could not modify his or her desktop links in any way. "Desktop Links" could be another policy, and it could have the Boolean parts "Create Links," "Delete Links," and "Modify Links." As another example, "Password Expiration" could be a policy, and "Number of days" (a numeric value) could be its part.

Policies and parts are analogous to a group of controls in a dialog box that are all enabled by a single check box. The check box, which corresponds to whether or not the policy is enabled, "turns on" the controls in the dialog box (the policy parts) and allows data to be entered into the controls. A policy with no parts (that is, no associated controls) is analogous to a single check box.

The following types of policies can be specified:

A user-specific policy can be specified for each user or group. A default set of policies can be specified for users or groups who do not have sets of policies defined for them explicitly. Most policies are user-specific. User-specific policies are always merged into the HKEY_CURRENT_USER key of the registry.
A machine-specific policy should not change according to user. A machine-specific policy applies to all users. It does not follow users as they move between different computers. Machine-specific policies are always merged into the HKEY_LOCAL_MACHINE key of the registry.