Overview of iSeries Access for Windows policies

Use iSeries™ Access for Windows^® System Policies to restrict users from certain actions, and to suggest or require certain configuration features.

System policies can apply to individual Windows user profiles, and specific PCs. However, these policies do not offer control over iSeries server resources, and are not a substitute for iSeries security. For a description of what you can do with these policies, refer to Types and scopes of policies.

Use of Group Policy to control use and configuration of iSeries Access for Windows had limited testing and can therefore provide unpredictable results. For additional information about Group Policy, see Microsoft^® documentation. The remainder of this topic discusses the tested, supported use of iSeries Access for Windows policies.

Policy support in your network

Policies can reside on a file server. When configured on a file server, each time users sign-on to their Windows workstation, their workstation downloads all the policies that apply to that Windows user profile. The user's PC applies the policies to the registry before the user does anything on the workstation. Each Windows operating system comes with the code needed to download policies.

To use the full capability of policies, you need the following:

A primary logon server
A policy server

You can use IBM^® iSeries Support for Windows Network Neighborhood (iSeries NetServer™) as the policy server.

See Set up your system to use policies for more information.

Policy files

Policy definitions are contained in policy templates, which organize the policies into categories. iSeries Access for Windows provides five policy templates, one for each of the following functions:

Restricting iSeries Access for Windows functions for a given system (sysname.adm)
Restricting specific iSeries Access for Windows function at runtime (caerestr.adm)
Restrict which components users may install or uninstall (caeinrst.adm)
Mandate or suggest configuration settings for specific environments, the systems within those environments, and some configurable values for those systems (config.adm)
Suggest or mandate global configurable values (caecfg.adm)

You must generate the policy templates with the CWBADGEN utility before creating or modifying specific policies. Then use the Microsoft System Policy Editor or the Microsoft Management Console Group Policy snap-in, gpedit.msc, to activate the templates and set their constituent policies. If using the Microsoft System Policy Editor, save the changes to a policy file. If using gpedit.msc, the policy settings are stored in a Group Policy Object automatically. See Microsoft documentation for details.

See Create policies for more information.