Group Policy Administration Guide

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon:

In the details pane, double-click Acquire Kerberos tickets on logon (krb5_ccache_type), and then select the Define this Policy Setting check box.

In the String value box, do one of the following:

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon:

In the details pane, double-click Allow logon rights (require_membership_of), and then select the Define this Policy Setting check box.

Click and then locate the users or groups that you want to grant logon rights.

Or, in the Users and/or Groups box, type a comma-separated list of the users and groups that you want. In the list, you can use short domain names with Active Directory account names and group names. You can also use local account names and local user groups as well as security identifiers ( SIDs) in string format.

For example, you could enter the following comma-separated list:

CORP\johndoe, janedoe@corp.mycorp.com, CORP\domain^users, S-1-1-0

In the example, the entry s-1-1-0 is a SID in string format.

Note: To separate the domain name from the user name or the group name in the AD account logon syntax, you must use a backslash (\). Example: likewisedemo.com\steve.

Grant the users and groups access to the Likewise cell that contains the target computer object.

In Active Directory Users and Computers or in the Group Policy Management Console, edit or create a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Allow offline logon support, and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon.

In the details pane, double-click Allow cached logons (cached_login), and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Turn off client LANMAN authentication (client lanman auth), and then select the Define this policy setting check box.

Select Enabled or Disabled.

Note: If you disable LANMAN authentication, only servers that support NT password hashes will accept an SMB client's connection. For example, if the client's LANMAN authentication is disabled, the client will be unable to connect to Windows 95 or Windows 98 servers.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Turn on client NTLMv2 authentication (client ntlmv2 auth), and then select the Define this policy setting check box.

Select either Enabled or Disabled, with the following results:

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Group Policy Agent:

In the details pane, double-click Computer policy refresh interval, and then select the Define this policy setting check box.

In the Refresh interval box, enter the time in minutes that you want to set.

You can set the refresh interval from 5 minutes to 9999 minutes, or about 7 days.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon.

In the details pane, double-click Copy template files when creating home directory (skel), and then select the Define this Policy Setting check box.

In the Path to skeleton template directory box, type the path that you want -- for example, /etc/skel.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon.

In the details pane, double-click Create a .k5login file in user home directory (create_k5login), and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

When enabled, Kerberos is allowed to create a .k5login file in the home directory of a given user account. When disabled, Kerberos is not allowed to create a .k5login file.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon.

In the details pane, double-click Create home directory for user account at logon (create_homedir), and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click  Logon.

In the details pane, double-click File creation mask for the contents of the home directory (umask), and then select the Define this Policy Setting check box.

Under Default File Permissions and under Default Directory Permissions, select the options that you want.

Or, in the Umask value box, type a umask value for the permission level that you want, and then click Set.

For example, if you specify an umask value of 022, the file permissions are set as follows: Read-write access for files and read-write-search for directories you own. All others have read access only to your files and read-search access to your directories.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Digitally sign client communications (client signing), and then select the Define this policy setting check box.

In the drop-down list, click the option that you want. For example, to enable signing and to make it mandatory, click signing is mandatory.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Digitally sign server communications (server signing), and then select the Define this policy setting check box.

In the drop-down list, click the option that you want. For example, to offer signing and to make it mandatory, click signing is required.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Allow access to Samba server null-password accounts (null passwords), and then select the Define this policy setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon.

In the details pane, double-click Log PAM debugging information, and then select the Define this Policy Setting check box.

Select either Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon.

In the details pane, double-click Log on using Kerberos authentication (krb5_auth), and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Set the Maximum Tolerance for Kerberos Clock Skew (clockskew), and then select the Define this policy setting check box.

In the Maximum tolerance box, enter the maximum amount of time, in minutes, to allow for the clock skew.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Group Policy Agent:

In the details pane, double-click Monitor sudoers file, and then select the Define this policy setting check box.

To monitor the sudoers file, select Enabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Automatically refresh Kerberos tickets (winbind refresh tickets), and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Replacement character for names with spaces, and then select the Define this Policy Setting check box.

In the Character to replace spaces in names with box, type the character that you want -- for example, ^.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Samba hostname resolver cache timeout (name cache timeout), and then select the Define this policy setting check box.

In the name cache timeout box, enter the minutes that you want to set for the cache timeout.

Tip: To disable caching, enter 0.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Server LDAP connection timeout (ldap timeout), and then select the Define this policy setting check box.

In the LDAP Timeout box, enter the seconds that you want to set for the LDAP timeout.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Send encrypted password to third-party SMB servers (client plaintext auth), and then select the Define this policy setting check box.

Select Enabled or Disabled.

Tip: To require the client to send an encrypted password, select Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, edit or create a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click  Authorization and Identification.

In the details pane, double-click Depth of nested group expansion, and then select the Define this Policy Setting check box.

In the Depth of group expansion box, type a number to specify how many levels you want authentication daemon to process when it expands nested groups into a membership list.

For example, if you set the depth of group expansion to 0, group expansion is in effect disabled. If you set the depth of group expansion to 7 -- a typical setting -- the daemon processes nested groups as deep as 7 levels.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Winbind: ID mapping cache expiration time (ismap expire time), and then select the Define this Policy Setting check box.

In the Expiration time box, enter the time, in minutes, that you want.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Winbind: ID mapping negative cache expiration time ( idmap negative time), and then select the Define this Policy Setting check box.

In the Negative cache time box, enter the time, in minutes, that you want.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click  Authorization and Identification.

In the details pane, double-click Machine account password expiration time (machine password timeout), and then select the Define this Policy Setting check box.

In the Expiration Time box, enter the time, in days, that you want.

Important: To avoid issues with Kerberos key tables and single sign-on, the value you set in the Expiration Time box must be at least twice the maximum lifetime for user tickets, plus a little more time to account for the permitted clock skew. The expiration time for a user ticket is set by using an Active Directory group policy called Maximum lifetime for user ticket. The default user ticket lifetime is 10 hours; the default Likewise machine password lifetime is 30 days.

Open the default domain policy in the Group Policy Object Editor.

In the console tree under Computer Configuration, expand Windows Settings, expand Security Settings, expand Account Policies, and then click Kerberos policy.

In the details pane, double-click Maximum lifetime for user ticket.

In the Ticket expires in box, make sure that the number of hours is no more than half that of the value you set in the Expiration Time  box of the Likewise group policy for the machine account password expiration time.

For more information, see Fix a Key Table Entry-Ticket Mismatch.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification.

In the details pane, double-click Cache expiration time, and then select the Define this Policy Setting check box.

In the Cache timeout box, enter the time, in minutes, that you want.  

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon:

In the details pane, double-click Denied logon rights message (not_a_member_error), and then select the Define this policy setting check box.

In the Logon error message box, type the text that you want to display.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Logon:

In the details pane, double-click Local account password expiration warning, and then select the Define this policy setting check box.

In the Password expiration warning box, enter the number of days that you want.

Tip: To turn off the warning on target Linux computers, enter 0.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Group Policy Agent:

In the details pane, double-click User policy loopback processing mode, and then select the Define this policy setting check box.

In the list, click the loopback processing mode that you want to set.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Group Policy Agent:

In the details pane, double-click User policy refresh interval, and then select the Define this policy setting check box.

In the Refresh interval box, enter the time in minutes that you want to set.

You can set the refresh interval from 5 minutes to 9999 minutes, or about 7 days.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification:

In the details pane, double-click Lsassd: Disable logging of network connectivity events, and then select the Define this policy setting check box.

Select Enabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification:

In the details pane, double-click Lsassd: Disable system time synchronization, and then select the Define this policy setting check box.

Select Enabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification:

In the details pane, double-click Lsassd: Enable MOTD display during logon, and then select the Define this policy setting check box.

Select Enabled.

In the console tree, find the Display a Message of the Day group policy, define it, and add your message to it; for more information, see Display a Message of the Day.

To locate the Display a Message of the Day group policy, in the console tree under Computer Configuration, expand Unix and Linux Settings, and then expand Message Settings.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification:

In the details pane, double-click Lsassd: Enable use of the event log, and then select the Define this policy setting check box.

Select Enabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the console tree under Computer Configuration, expand Unix and Linux Settings, expand Likewise Settings, and then click Authorization and Identification:

In the details pane, double-click Lsassd: Prepend default domain name for AD users and groups, and then select the Define this policy setting check box.

Select Enabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand File System Settings, and then click AutoMount:

In the details pane, double-click AutoMount, and then select the Define this Policy Setting check box.

Click Add, type the name of the file you want, or click Browse and then find the file you want.

If the file is executable, select the File is executable check box.  

Click OK.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand File System Settings, and then click Files, Directories and Links.

In the details pane, double-click Create Directories, Install Files, Configure Links, and then select the Define this Policy Setting check box.

Click Add, click the type of object that you want, and then click OK.

Use the Object Editor that appears to set the object's paths and other file system properties.

Tip: To change an object's properties later, click the object in the list, and then click Edit.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand File System Settings, and then click File System Mounts (fstab).

In the details pane, double-click File System Mount, and then select the Define this Policy Setting check box.

Click Add, click the type of file system that you want to mount, and then click OK.  

Use the Add New Mount Wizard to specify the mount details for the type of file system that you want to mount.

After you use the wizard to add a file system, you can edit the mount details and options by clicking the mount entry in the list and then clicking Edit.

To disable the mount, in the list of mount entries, under Status, double-click Enabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Logging and Audit Settings, and then click SysLog:

In the details pane, double-click SysLog, and then select the Define this Policy Setting check box.

Click Add.

In the Syslog Policy Editor, in the Destination Type list, click the destination for the syslog.

The box below the Destination Type list changes depending on the destination type that you select:

Click in the Facilities box and then click to select the facilities that you want to log.

Select the facilities that you want. You can select All, or you can select Selected Items, and then select the check boxes for the facilities that you want in the list.

To enter a custom list of facilities, select Custom Entry, and then type a comma-separated list of the facilities that you want to use -- for example: cron, daemon, auth, kern

In the list under Priorities, click the priority level for which you want to log events.  

In the list under Filter, click the filter that you want to apply to the priority level, and then click OK.

Tip: To change a log's options later, click a log in the list, and then click Edit.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Logging and Audit Settings, and then click AppArmor.

In the details pane, double-click AppArmor, and then select the Define this Policy Setting check box.

Click Add, find the security profile that you want to use, and then click Open.

In the list under Profile Mode, do one of the following:

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Logging and Audit Settings, and then click SELinux.

In the details pane, double-click SELinux, and then select the Define this policy setting check box.

In the SE Linux list, do one of the following:

In the SE Linux Type list, click either targeted or strict.

Selecting targeted protects only targeted network daemons. The default targeted policy protects the following daemons on Red Hat Enterprise Linux 4: dhcpd, httpd (apache.te), named, nscd, ntpd, portmap, snmpd, squid, and syslogd. The rest of the system runs in the unconfined_t domain. The policy files for these daemons are in /etc/selinux/targeted/src/policy/domains/program and might vary depending on the version of Red Hat Enterprise Linux that you are using.

Selecting strict provides full SELinux protection for all daemons. The system defines security contexts for all objects and subjects, and the policy enforcement server processes every action.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Logging and Audit Settings, and then click LogRotate.

In the details pane, double-click Rotate logs, and then select the Define this Policy Setting check box.

Click Add.

In the Log Rotate Policy Editor, under the General Options tab, set the options that you want.

Click the Log Options tab, and then set the options that you want.

Click the Mail/Script Options tab, and then set the options that you want.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Message Settings, and then click Login Prompt.

In the details pane, double-click Login Prompt (/etc/issue), select the Define this Policy Setting check box, and then in the Text Value box, type your message.

In your message, you can use escape codes that getty (on Unix) or agetty (on Linux) recognizes. For example, if you write Welcome to \s \r \l, on a Linux computer, agetty replaces \s with the name of the operating system, \r with the kernel version, and \l with the name of the terminal device. For a list of escape codes, see the getty or agetty man pages for your system.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Message Settings, and then click Message of the Day:

In the details pane, double-click Message of the day (/etc/motd), select the Define this Policy Setting check box, and then in the Text Value box, type your message.

Tip: Limit the size of your message to one screen.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Security Settings, and then click SUDO command:

In the details pane, double-click Define Sudoer file, select the Define this Policy Setting check box, and then in the Current file content box, type your commands.

Or, to import a sudo configuration file, click Import, and then find the file that you want.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Task Settings, and then click Crontab/Cron.d.

In the details pane, double-click Crontab Settings, and then select the Define this Policy Setting check box.

To specify the crontab file type, click Change Type, select either /etc/cron.d or crontab, and then click OK.

Selecting /etc/cron.d -- which is not supported by the Sun Solaris, Mac OS X, or IBM AIX operating systems -- adds the file to the /etc/cron.d directory while preserving existing files and other files inherited from policy objects.

Selecting crontab -- which works with most systems, including Solaris, AIX, and Mac OS X -- uses the crontab utility to install the file in the root account, overriding the account's existing crontab settings and any files inherited from policy objects.

In the Current file content box, type your command. Example:

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Task Settings, and then click Run Script:

In the details pane, double-click Script file, and then select the Define this Policy Setting check box.

In the Current file content box, type your script. Example:

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, and then click Network Settings.

In the details pane, double-click DNS, and then select the Define this policy setting check box.

In the DNS Servers box, type the DNS address that you want to use. To enter more than one address, you must put each additional address on a new line.

In the Search Domains box, optionally type the search domain that you want.

To enter multiple search domains, separate each by a comma. Domains are searched in the order you list them. To include local as one of the search domains, the target computers must be running OS X 10.4 or later and local must be first. Example:

local, likewise.com, campus.college.edu

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then expand Energy Saver:

Click Options.

In the details pane, double-click Automatic restart on power loss, and then select the Define this Policy Setting check box.

Click Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Bluetooth:

In the details pane, double-click Open Bluetooth Setup Assistant at startup when no input device is present, and then select the Define this policy setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then expand Energy Saver:

Click Sleep.

In the details pane, double-click Disk Sleep Timer, and then select the Define this Policy Setting check box.

Click Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then expand Energy Saver:

Click Sleep.

In the details pane, double-click Display Sleep Timer, and then select the Define this Policy Setting check box.

In the Minutes box, enter the period of inactivity after which the policy is to put the computer to sleep.

Note: To set the screen to never sleep, enter 0.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Firewall:

In the details pane, double-click Block UDP traffic usage, and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Security:

In the details pane, double-click Disable automatic user login, and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Firewall:

In the details pane, double-click Turn on firewall logging, and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Security:

In the details pane, double-click Secure system preferences with password, and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Firewall:

In the details pane, double-click Use firewall stealth mode, and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Security:

In the details pane, double-click Use secure virtual memory, and then select the Define this Policy Setting check box.

Select Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Bluetooth:

In the details pane, double-click Share my Internet connection with other Bluetooth devices, and then select the Define this policy setting check box.

Select Enabled or Disabled. When Enabled is selected, Internet connection sharing is on; when Disabled is selected, sharing is off.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then expand Energy Saver:

Click Options.

In the details pane, double-click Sleep on power button, and then select the Define this Policy Setting check box.

Click Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then expand Energy Saver:

Click Sleep.

In the details pane, double-click System Sleep Timer, and then select the Define this Policy Setting check box.

In the Minutes box, enter the period of inactivity after which the policy is to put the computer to sleep.

Note: To set the computer to never sleep, enter 0.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Bluetooth:

In the details pane, double-click Turn Bluetooth on or off, and then select the Define this policy setting check box.

Select Enabled or Disabled. When Enabled is selected, Bluetooth is on; when Disabled is selected, Bluetooth is off.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organizational unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then click Internet and Network.

In the details pane, double-click AppleTalk, and then select the Define this policy setting check box.

In the list under Configure, click the option that you want. When Automatically is selected, AppleTalk is active. When Manually is selected, you must enter the Node ID and the Network ID.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then expand Energy Saver:

Click Options.

In the details pane, double-click Wake on LAN, and then select the Define this Policy Setting check box.

Click Enabled or Disabled.

In Active Directory Users and Computers or in the Group Policy Management Console, create or edit a group policy for the organization unit that you want, and then open it with the Group Policy Object Editor.

In the Group Policy Object Editor, in the console tree under Computer Configuration, expand Unix and Linux Settings, expand Mac Settings, expand Mac System Preferences, and then expand Energy Saver:

Click Options.

In the details pane, double-click Wake on modem ring, and then select the Define this Policy Setting check box.

Click Enabled or Disabled.