Google Answers Logo
View Question
 
Q: Can I set set Group Policies on a non-domain controller? ( No Answer,   1 Comment )
Question  
Subject: Can I set set Group Policies on a non-domain controller?
Category: Computers > Operating Systems
Asked by: sherpaj-ga
List Price: $11.00
Posted: 29 Sep 2004 18:10 PDT
Expires: 29 Oct 2004 18:10 PDT
Question ID: 408165
Can I do Global Security Policy on a non-DC 

Is there a way to set Group Policies (or something like them) and run
the Group Policy Editor (GPE) on a standalone server that is not a
domain controller?

I have a Win 2003 server that is standalone.

If the answer is NO, then I guess I?ll have to promote it to a DC and
my question will change to #1 - #6 below:
- I have 20-30 local accts on my stand alone Win 2003 server that I am
afraid will be blown away when I upgrade the server to a DC.
#1 Is this true, will they be blown away
#2 I believe they need to be converted to Active Directory accts.  I
heard there was a tool that does this conversion.  Where I could
download that and how do I use it?
#3 I am also hosting some webdav sites (webfolders) via IIS, will
upgrading make them stop working or mess with the complicated
permissions structure we have in there.
#4 I am also running SharePoint 2.0 team services on there, will that
get damaged or stop working in any way?
#5 I am also using it as a Terminal Server and have 10 accts that have
a complicated configuration (windows settings, outlook profiles, etc).
 Will that get affected in any way if I upgrade it to a DC?  Will the
users out there on the Internet that have RDC bookmarks to get into
these accts still be able to use these RDC bookmarks?
#6 My IIS on this sever is also running TSWEB. Will this be affected.
tsweb is a terminal server login page that uses a activex remote
desktop component. It is a Microsoft thing.

thanx in advnce
Answer  
There is no answer at this time.

Comments  
Subject: Re: Can I set set Group Policies on a non-domain controller?
From: blowdart-ga on 08 Oct 2004 08:56 PDT
 
Yes, you can administer a domain from another machine. On your Windows
Server installed media will be a file called admintools.msi, or check
your server for C:\winnt\system32\admintools.msi. Then, as long as you
are an AD admin of course you can administer to your hearts content.

To answer (some) of the other questions

1) Yes. Once a machine is a domain controller all local accounts will
be blown away.

2) To migrate accounts use the ADMT tool (see
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dssbg_rent_vgkz.asp
for instructions)

3) If the permissions relied on local users yes that will get messed up
4) (see 3)
5) (see 3)

6) Should have no effect, if it's administrative TS and not full blown
terminal services.

As a rule of thumb, however, never install IIS on a domain controller.
Never install anything on a domain controller it doesn't need to do a
job, be it SQL, SMTP or whatever. If someone compromises that server
then now they have comprised the AD, as they will be running as a
domain account.

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at answers-support@google.com with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  


Google Home - Answers FAQ - Terms of Service - Privacy Policy