Editing Windows Registry (section)

=== Legacy systems ===
With Windows 95, Windows 98, Windows ME and Windows NT 4.0, administrators can use a special file to be merged into the registry, called a policy file (<code>POLICY.POL</code>). The policy file allows administrators to prevent non-administrator users from changing registry settings like, for instance, the security level of [[Internet Explorer]] and the desktop background wallpaper. The policy file is primarily used in a business with a large number of computers where the business needs to be protected from rogue or careless users.

The default extension for the policy file is <code>.POL</code>.
The policy file filters the settings it enforces by user and by group (a "group" is a defined set of users). To do that the policy file merges into the registry, preventing users from circumventing it by simply changing back the settings.
The policy file is usually distributed through a LAN, but can be placed on the local computer.

The policy file is created by a free tool by Microsoft that goes by the filename <code>poledit.exe</code> for Windows 95/Windows 98 and with a computer management module for Windows NT. The editor requires administrative permissions to be run on systems that uses permissions.
The editor can also directly change the current registry settings of the local computer and if the remote registry service is installed and started on another computer it can also change the registry on that computer.
The policy editor loads the settings it can change from <code>.ADM</code> files, of which one is included, that contains the settings the Windows shell provides. The <code>.ADM</code> file is plain text and supports easy localisation by allowing all the strings to be stored in one place.