Password Policy Enforcer Installing the PPC

The Password Policy Client is designed to run on Windows 2000, XP, 2003, Vista, 2008, and 7. The PPC is also compatible with Windows Terminal Services and Remote Desktop Connection on these operating systems. If your network contains some computers that are running Windows NT or Windows 9x, then install the V3.6 PPC on these computers. PPE V3.6 is available from the ANIXIS web site.

System Requirements

Windows 2000, XP*, 2003*, 2003 R2*, Vista*, 2008*, 2008 R2, or 7*
* x86 and x64 editions.

1 Megabyte free disk space.

128 Kilobytes free RAM (per session if using Terminal Services).

You can install the PPC manually if you only have a few computers, but it is easier to perform an automated installation if you have many computers. Follow the instructions below to perform an automated installation of the PPC with Group Policy.

Create a Distribution Point

A distribution point can either be a UNC path to a server share, or a DFS (Distributed File System) path. Organizations with large, multi-site networks should use DFS as it offers fault tolerance and load sharing.

Use the PPE distribution point created earlier to distribute the PPC. If you did not create a PPE distribution point, then create one now.

Log on to a server as an administrator.

Create a shared network folder to distribute the files from.

Give the "Domain Computers" security group read access to the share, and limit write access to authorized personnel only.

Copy PPEClt61.msi into the Distribution Point

Start the PPE installer (PPE61.exe).

Read the license agreement carefully, and then click Yes if you accept all the license terms and conditions.

Select the Advanced option, and then click Next.

Right-click the PPEClt61.msi icon, click Copy, and then paste the file into the distribution point.

Give the "Domain Computers" security group read access to the PPEClt61.msi file in the distribution point.

Click Finish.

Create a Group Policy Object

Start the Group Policy Management Console (gpmc.msc).

Expand the forest and domain items in the left pane.

Right-click the domain root node in the left pane, and then click Create and Link a GPO Here... (Create a GPO in this domain, and Link it here... on Windows 2008).

Type "Password Policy Client", and then press ENTER.

If you are using Windows 2000 or 2003 without the Group Policy Management Console:

Start the Active Directory Users and Computers Console (dsa.msc).

Right-click the domain object in the left pane, and then click Properties.

Click the Group Policy tab, and then click New.

Type "Password Policy Client", and then press ENTER.

Edit the Group Policy Object

Right-click the Password Policy Client GPO, and then click Edit.

Expand the Computer Configuration, Policies (Server 2008 only), and Software Settings items.

Right-click the Software installation item, and then select New > Package.

Type the full UNC path to PPEClt61.msi in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, \\file server\distribution point share\PPEClt61.msi

Click Open.

Select the Assigned deployment method, and then click OK.

Close the Group Policy Object Editor.

Complete the Installation

Restart each computer to complete the installation. Windows installs the Password Policy Client during startup, and then immediately restarts the computer a second time to complete the installation.

Testing the PPC

Test the Password Policy Client by logging on to a computer and pressing the CTRL + ALT + DEL keys. Click Change Password... and the PPC should display a password policy panel on the Change Password dialog. A password policy message will also appear in the policy panel if a PPE policy has been assigned to you.