How System Policies Work

When the user logs in to a client, the client passes the location of the system policy file to Microsoft Windows:

• authentication_server:/opt/MSPolicy/ntconfig.pol on Windows NT

• authentication_server:/opt/MSPolicy/config.pol on Windows 95

Microsoft Windows then downloads system policies for computers and users from the /opt/MSPolicy directory on the authentication server. Windows NT and Windows 95 follow these rules for updating user information with system policy files:

1. If user profiles are enabled, Windows checks for a user policy file that matches the user name. If it finds one, it applies the user-specific policy. If it does not find a user policy file, it applies the default user policy file. On Windows NT, user profiles are always enabled.

2. Group policies are not applied if there is a policy file for a specific user. If Windows support for group policies is installed on a client running Windows 95, Windows checks whether the user is registered as a member of any secondary UNIX groups. If so, group policies are downloaded, starting with the lowest priority group and ending with the highest priority group. Group policies are processed for all groups to which the user belongs. The group with the highest priority is processed last so the settings in that group's policy file supersede those in lower priority groups. The client on Windows NT does not download or process group policies.

3. All settings are then copied into the USER.DAT portion of the Registry.

4. Microsoft Windows checks for a computer policy file to match the computer name. If one exists, Microsoft Windows applies the computer-specific policies to the user's desktop environment. If a policy file for that computer name does not exist, Microsoft Windows applies the default computer policy.

5. This data is then copied into the SYSTEM.DAT portion of the Registry.