Can we start with local GPOs and move to AD policies after our Win2k domain upgrade?

Our organization has an NT domain with 3000 computers, 70% of which are Windows 2000. The domain will be upgraded soon to Windows 2000 with Active Directory implemented, but the timing for this implementation is uncertain. One of the major projects for 2003 is the lock down of the workstations. Should we wait for AD to be implemented and use domain-linked group policy objects (GPOs) or can we start with local GPOs and then easily move policies to Active Directory?
Editing local GPOs on 2100 computers is going to be heartbreaking. If locking down desktops is a high priority now, then I'd deploy the policy settings via login scripts and then do a proper policy implementation when you have Active Directory. The problem with login scripts is that users must be administrators in order to apply those policies. That's where tools such as Profile Maker from AutoProf come in handy. It's a relatively inexpensive tool that can read ADM (Application Data Management) files and deploy those settings via login scripts without requiring you to add users to the local administrators group. The tool is also exceptionally easy to use. I'd use something similar until you have a proper Active Directory implementation.

This was first published in February 2003

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top