6.2 Introducing the System Policy Editor

You create and edit system policies with the System Policy Editor (poledit.exe), which is normally installed only when you install a member of the Windows 2000 or NT server product families. It can be run from Windows 2000 Professional or NT Workstation, though, if you can legally obtain it from a server installation. Don't confuse this version of System Policy Editor with the Windows 95/98 version: if you want to create policies that Win9x clients can use, you must use the Win9x editor, and the same is true for the NT version.^[4]

^[4] Actually, you can use the 2000/NT policy editor under Win95 or 98 with no ill effect, as long as you use the right .ADM files.

If you don't have System Policy Editor installed, you can quickly install it (along with the User Manager for Domains, Server Manager, the Services for Macintosh Manager, and several others) by running the setup.bat file in the \clients\servtools\winnt directory of your NT Server CD. Once you've completed the installation, you'll have access to the System Policy Editor.

6.2.1 Learning the System Policy Editor Interface

When you use RegEdt32 or RegEdit, you can definitely tell that you're using software that predates Windows 2000. Although both take on some aspects of the Windows 2000 GUI, they're indisputably different from other Windows 2000 software such as Internet Explorer or the system shell. POLEDIT, on the other hand, has an interface very similar to the shell, making it more immediately familiar.

The main window for POLEDIT is shown in Figure 6.1. In the figure, each computer, user, or group policy is represented by a large icon. Double-clicking one of these icons opens the associated policy, and policies may be created or deleted from this view as well.

Figure 6.1. The System Policy Editor interface

6.2.1.1 Controlling what you see

The View menu allows you to change POLEDIT 's display in a number of ways, all of which are similar to commands in the shell and other administrative tools.

The first two commands in the menu are window dressing: the ViewToolbar command controls the state of POLEDIT 's toolbar. The toolbar is visible when this command is checked (the default) and invisible when it's not. Like RegEdit, POLEDIT has a status bar that can occupy the bottom margin of the application window. The ViewStatus Bar command governs whether this decorative but useless bar appears or not.

The remaining View menu commands let you change the format of the display. Unless you change it, POLEDIT displays policies as large icons; this default corresponds to the ViewLarge Icons command. If you prefer, you can instead see policies as small icons (ViewSmall Icons) or an alphabetically sorted list. For some reason, Microsoft included both the ViewList and ViewDetails commands, even though they display the same information in the same format!

The settings you choose in the View menu are stored with the policy file, so when you reload a new file it appears as it was when you last had it open.

6.2.1.2 Navigating in the policy window

As in Explorer, you can move from item to item in POLEDIT 's window with the arrow, PgUp, PgDn, Home, and End keys. When a policy is selected, you can open it by double-clicking it, pressing the Enter key, or using the EditProperties... command.