Local Policy in MMC. How to copy/paste to multiple machines.

[doomie]

I have 30 machines or so to create local policy lockdowns on. I add in the Local Policy snap-in on the computer, create the .MSC file, configure all the settings, then that computer is done. But when I copy the .MSC file to the next computer via USB drive, all the settings become unconfigured. Is there a way to copy local policy settings manually to each computer or am I out of luck? I have to manually configure each MSC file on each individual machine and that takes quite awhile.

 

Thanks!

 

p.s. all the machines are exactly the same. I dont know why this wouldnt work especially if the Local Policy snapin is on all machines in the first place.

[ITWombat]

There's a slight confusion here. The MSC file only stores the layout of the management console.

 

The console is only a front end. It does not store the the policy data.

 

I know you can create and share admin template files between machines but I am not sure about security policies.

 

Don't you have Active Directory? That's the real solution for what you want to do.

 

 

 

 

 

*edited Saturday morning to insert punctuation after Friday night had worn off*

[Guest]

Copy the folder c:\WINDOWS\system32\GroupPolicy from you master machine to your other PCs.

 

Beware that local Group Polices are global, and will affect the administrator account aswell.

[ChrisH]

There is a KB around somewhere about making it so the local administrator isnt affected. It is an old one so I dont know if it still works but it is probably just denying the admin permission on the policy.

[GrumbleDook]

if you are doing local lockdowns then have a look at the Shared Computer Toolkit ... a bit like deepfreeze and so on ...

[tarquel]

ahhh "Shared Computer Toolkit" - Still been meaning to use that for our music suite that is "all alone" on a workgroup and not attached to the rest of the network....

 

 

...one day i might get around to it hehe

 

Nath

[Ric_]

@tarquel: Got round that with some special GPOs to allow local use of apps and the Citrix client for access to the network proper. Allows all those lovely MS updates and Sophos updates to go on automagically

[W32Jbot]

Da Daa http://support.microsoft.com/kb/293655 i used it to lock down some SEN standalones for just running CD's on XP pro a few years back. When finished there is a file you just copy over on floppy to all your other stations and some magic happens.