Deploying Security Policy
Security policy can be easily deployed in a Windows Installer (.msi) file. An .msi file is a self-contained installation package that can be deployed, installed, and uninstalled in a number of ways. For example, you can deploy an .msi file in any of the following ways:
Running the .msi file on the computer where you want to deploy the policy, either from the local disk or from a share.
Using Group Policy on Microsoft Windows 2000.
Using Microsoft® Systems Management Server (SMS) 2.0 on Microsoft Windows NT and Windows 2000.
Creating Windows Installer Files
The .NET Framework Configuration tool (Mscorcfg.msc) provides a wizard for creating Windows Installer files. The wizard can create an Installer file that corresponds to one of the three configurable policy levels, but not all of them concurrently. If you are administering security policy for all three configurable levels, you must create three different Windows Installer files and deploy them individually.
The wizard creates the Installer file using the current policy settings of the computer where the wizard executes. For example, to create a user policy for deployment to a group of users, you configure the user policy on your current computer, create the Installer file with the wizard, then return the user policy of the current computer to its original state.
To create a Windows Installer file:
Run the .NET Framework Configuration tool (Mscorcfg.msc).
In the .NET Framework versions 1.0 and 1.1, type the following at the command prompt: %Systemroot%\Microsoft.NET\Framework\versionNumber\Mscorcfg.msc.
In the .NET Framework 2.0, start the SDK Command Prompt and type mscorcfg.msc.
In the left pane, right-click the Runtime Security Policy node.
From the menu, choose Create Deployment Package.
Follow the Deployment Package wizard instructions to create the .msi file.
When you deploy policy by using an installer file that is created by the .NET Framework Configuration Tool (Mscorcfg.msc), the following applies:
Policy installation affects only the version of the runtime that you targeted when you created the installation file. For example, if you use the .NET Framework Configuration tool version 2.0, your installation file changes only .NET Framework version 2.0 policy.
In some cases, the installer does not generate an error if installation of a new policy failed. To verify that policy was installed succesfully, inspect policy by using the .NET Framework Configuration tool, the Code Access Security Policy Tool (Caspol.exe), or by manually inspecting the policy files in a text editor after deployment.
To update the policy displayed by the .NET Framework Configuration tool, you must shut down the tool and restart it.
Custom Deployment
You can deploy Windows Installer files in several ways, including a startup script, e-mail distribution, or distribution from a shared drive. The easiest way to deploy security policy from a Windows Installer file is to run the file from the computer where you want to update the security policy. You can do this by simply double-clicking the .msi file. To roll back the installation, right-click the .msi file and choose Uninstall.
Make sure that the user account under which the policy is installed has adequate privileges to access the configuration files you are modifying. For example, if you are currently logged on using an account that does not have permission to modify the enterprise configuration file, and the .msi file you are deploying must modify the enterprise configuration file, the installation will not succeed. Note that the Windows Installer package does not produce an error if the current account does not have sufficient permission to modify the configuration file.
Group Policy Deployment
If you use a Windows 2000 server for policy administration, you can use Group Policy with a Windows Installer file to deploy security policy to the workstations on your network. Simply import the Installer file using the group policy MMC snap-in, or place the Installer file in a pre-existing directory that you use as an installation point. After you have configured Group Policy to publish the Installer file, the security policy will be updated the next time users log on to the network. Note that you must have a domain controller present on your network to deploy security policy using Group Policy. For more information about using Group Policy, see the Microsoft Windows 2000 Server Help.
SMS Deployment
You can use Microsoft Systems Management Server (SMS) 2.0 to publish security policy to computers on a network that uses a Windows 2000 Server or Windows NT Server. SMS is a standalone server product that manages software installation and configuration in large enterprises. SMS is particularly useful in Windows NT Server-based networks because it provides the Group Policy functionality that Windows 2000 Server-based networks have. Use one of the compatible methods to convert the .msi file into an SMS software package, then use SMS to install the package in the same way as any other software package. For more information about creating and deploying SMS software packages, see the SMS documentation.
See Also
Other Resources
General Security Policy Administration
Security Policy Best Practices