(E-Mail Removed) wrote:
> The main problems and that we apply NT4 polices and
> romaing profiles and will be moving to Windows 2000
> polices and romaing profiles. We provide a high level of
> client lockdown for the user through policies (no desktop
> icons, no run, etc) and we find when a user with 2000
> policies and profile logos on to a 2000 client all is fine
> but when that user goes to a NT4 client the polices only
> partially apply and the security is compromised.
My guess is that the registry keys manipulated by NT policies are not
the same as those of Windows 2000. You could check by looking at the ADM
files of each (if you can find them).
I'm not aware of any official Microsoft guidance on this which is why I
opted for the "do not log onto NT machines" policy when I did my own
migration. The potential mess it could cause in HKCU does not bear
thinking about.
One thing not many people know, is that even after the migration, your
shiny new profiles will still have horrible legacy stuff in their HKCU
hives from old software, and bits of NT4. I ended up cleaning most of
them manually, as I didn't know any other way to do it. In an ideal
world, you'd clean them and then compact them, otherwise the files
within which they reside will be too big (over 1Mb in some cases); again
I'm not sure how to do this.
--
Gerry Hickman (London UK)