System Policies

Like Windows 95, Windows NT Workstation 4.0 now includes system policies, and the System Policy Editor. These are powerful tools for managing a mixed environment network.

System policies allow you to override local registry values for user or computer settings. When a user logs on, system policy settings overwrite the current settings in the user's registry. This allows administrators to control individual desktop and registry settings.

In Windows 95, however, the following apply:

• System policies are only stored on the logon server rather than the local computer.

• Group policies, if used, must be enabled on each computer running Windows 95. You can do so when you install Windows 95, using a custom setup script. Or, use the Add/Remove Programs option in Control Panel after Windows 95 is installed.

System Policy Editor

To centrally manage both Windows NT Workstation and Windows 95 computers, use the System Policy Editor. This tool lets you manage groups of computers by configuring the registry settings of those computers. The alternative is to edit the registry on each computer, using Regedt.exe (for Windows 95) or Regedt32.exe (for Windows NT Workstation). System Policy Editor is easier to use, since it does not require a understanding of the registry structure and syntax.

When you use the System Policy Editor on a computer running Windows NT Workstation or Windows NT Server, a Ntconfig.pol file is created. This file is read and interpreted by the Windows NT Workstation client software, overriding any conflicting information in that computer's registry. When you use the System Policy Editor on a computer running Windows 95, a Config.pol file is created. This file is similar to the Ntconfig.pol file, but has a different file format and reflects differences in the registries of the two operating systems. Place these files on the logon share.

To apply system policies to a network that uses both Windows 95 and Windows NT Workstation, run the System Policy Editor once from each platform, to produce the two different files.

The System Policy Editor cannot be used to set binary values. Hardware component information is often stored as binary data. If you look at a Windows NT registry using RegEdit32.exe, you will see binary value entries marked with data type REG_BINARY. If you look at a Windows 95 registry using RegEdit.exe, you will see binary value entries marked with an icon showing 0s and 1s, rather than the letters ab. These values cannot be set using System Policy Editor. Use the Registry Editor, or make changes on a per-computer basis via the user interface.

You can use the System Policy Editor to edit the HKeyLocalMachine and HKeyCurrentUser portions of the interface. If you need to access a different part of the registry, such as HKeyDynData, use the Registry Editor.