다음을 통해 공유

Deploying Security Policy

  • 아티클

Security policy can be easily deployed in a Windows Installer (.msi) file. An .msi file is a self-contained installation package that can be deployed, installed, and uninstalled in a number of ways. For example, you can deploy an .msi file in any of the following ways:

  • Running the .msi file on the computer where you want to deploy the policy, either from the local disk or from a share.
  • Using Group Policy on Microsoft Windows 2000.
  • Using Microsoft® Systems Management Server (SMS) 2.0 on Microsoft Windows NT and Windows 2000.

Creating Windows Installer Files

The .NET Framework Configuration tool (Mscorcfg.msc) provides a wizard for creating Windows Installer files. The wizard can create an Installer file that corresponds to one of the three configurable policy levels, but not all of them concurrently. If you are administering security policy for all three configurable levels, you must create three different Windows Installer files and deploy them individually.

The wizard creates the Installer file using the current policy settings of the computer where the wizard executes. For example, to create a user policy for deployment to a group of users, you configure the user policy on your current computer, create the Installer file with the wizard, then return the user policy of the current computer to its original state.

To create a Windows Installer file

  1. Run the .NET Framework Configuration tool (Mscorcfg.msc). At the command prompt, type:

    mmc %systemroot%\Microsoft.NET\Framework\<versionNumber>\mscorcfg.msc

  2. In the left pane, right-click the Runtime Security Policy node.

  3. From the menu, choose Create Deployment Package.

  4. Follow the Deployment Package wizard instructions to create the .msi file.

Custom Deployment

You can deploy Windows Installer files in several ways, including a startup script, e-mail distribution, or distribution from a shared drive. The easiest way to deploy security policy from a Windows Installer file is to run the file from the computer where you want to update the security policy. You can do this by simply double-clicking the .msi file. To roll back the installation, right-click the .msi file and choose Uninstall.

Make sure that the user account under which the policy is installed has adequate privileges to access the configuration files you are modifying. For example, if you are currently logged on using an account that does not have permission to modify the enterprise configuration file, and the .msi file you are deploying must modify the enterprise configuration file, the installation will not succeed. Note that the Windows Installer package does not produce an error if the current account does not have sufficient permission to modify the configuration file.

Group Policy Deployment

If you use a Windows 2000 server for policy administration, you can use Group Policy with a Windows Installer file to deploy security policy to the workstations on your network. Simply import the Installer file using the group policy MMC snap-in, or place the Installer file in a pre-existing directory that you use as an installation point. After you have configured Group Policy to publish the Installer file, the security policy will be updated the next time users log on to the network. Note that you must have a domain controller present on your network to deploy security policy using Group Policy. For more information about using Group Policy, see the Microsoft Windows 2000 Server Help.

SMS Deployment

You can use Microsoft Systems Management Server (SMS) 2.0 to publish security policy to computers on a network that uses a Windows 2000 Server or Windows NT Server. SMS is a standalone server product that manages software installation and configuration in large enterprises. SMS is particularly useful in Windows NT Server-based networks because it provides the Group Policy functionality that Windows 2000 Server-based networks have. Use one of the compatible methods to convert the .msi file into an SMS software package, then use SMS to install the package in the same way as any other software package. For more information about creating and deploying SMS software packages, see the SMS documentation.

See Also

General Security Policy Administration | Security Policy Best Practices