Because of the confusing and sometimes insufficient documentation from Microsoft, here is an article to start with the configuration of users' desktop PCs on the network in a Windows domain. Some premises
:
- you can allow or deny access with the same user account from multiple machines at once (and simultaneous access is useful if you need logghino users each time they use the computer - eg. Salt Internet for small and medium-sized structures);
- all open TCP / IP server to the network should be open, as the transmission of the Windows profile needs some ports for RPC randomly selected after 1024, and is forcing difficult (it acts on the DCOM component services) and inconvenient (other Windows services do not work - eg. some fundamental issues of svchost. exe);
- accounts of the Domain Admins can add and remove pc from domain, and then if they are part of the Administrators can also work on the machines at the bottom and enter the server!)
- computer objects are created in a domain automatically the first time, users of course not.
To start the server install the Group Policy Management Console, available for download here . Once installed, you can define
of new policies, in addition to those already in default, with the right button on the item concerned in the left menu. The policy comes into operation when it is "linked" to the domain. E 'competitors can set policies, but the Board did not do it because in that case we must carefully check the above. It 'better to be associated with each policy the group user. To bind it to all users, only aggungere Autenticated Users .
To edit the policy, right button on the item on the menu to the left and then click Edit. Not describe here because each group of entries is a detailed description of the console. Know that you can now also distribute installation packages formats msi.
strongly recommend that you remove the link from the Default Domain Policies and apply new ones do not delete old.
Finally, if the PC had some problems to create the local profile with the domain user and give errors like "Can not copy ..." any attempt to access, then there is a corrupted file in C: \\ Documents and Settings \\ Default User. Saved somewhere else and copy the contents of the folder inside the folder contents of any other person, except the one in use and All Users. Then logged the user and let the pc time to rebuild the profile (one hour).
The information in this last part of the article apply to Windows 2000 and Windows XP Professional.
