Overview of iSeries Access for Windows policies

Use system policies to restrict users from certain actions, and to suggest or require certain configuration features.

iSeries Access for Windows policies can apply to individual Windows^® user profiles, and specific PCs. However, these iSeries Access for Windows policies do not offer control over the system resources, and are not a substitute for system security. For a description of what you can do with these policies, refer to Types and scopes of policies.

Use of Group Policy to control use and configuration of iSeries Access for Windows had limited testing and can therefore provide unpredictable results. For additional information about Group Policy, see Microsoft^® documentation. The remainder of this topic discusses the tested, supported use of iSeries Access for Windows policies.

Policy support in your network

Policies can reside on a file server. When configured on a file server, each time users sign-on to their Windows workstation, their workstation downloads all the policies that apply to that Windows user profile. The user's PC applies the policies to the registry before the user does anything on the workstation. Each Windows operating system comes with the code needed to download policies.

To use the full capability of policies, you need the following:

• A primary logon server

• A policy server

You can use IBM^® iSeries Support for Windows Network Neighborhood (iSeries NetServer™) as the policy server.

See Set up your system to use policies for more information.

Policy files

Policy definitions are contained in policy templates, which organize the policies into categories. Following are the iSeries Access for Windows five policy templates for each function.

• Restricting functions for a given system (sysname.adm)

• Restricting specific function at runtime (caerestr.adm)

• Restrict which components users can install or uninstall (caeinrst.adm)

• Mandate or suggest configuration settings for specific environments, the systems within those environments, and some configurable values for those systems (config.adm)

• Suggest or mandate global configurable values (caecfg.adm)

You must generate the policy templates with the CWBADGEN utility before creating or modifying specific policies. Then use the Microsoft System Policy Editor or the Microsoft Management Console Group Policy snap-in, gpedit.msc, to activate the templates and set their constituent policies. If using the Microsoft System Policy Editor, save the changes to a policy file. If using gpedit.msc, the policy settings are stored in a Group Policy Object automatically. See Microsoft documentation for details.

See Create policies for more information.

Parent topic:

Related concepts
Types and scopes of policies Microsoft System Policy Editor iSeries Access for Windows policy list