Windows 2000 Local Security Policy Management

Microsoft Windows 2000 manages local security policy settings on client workstations through a combination of the Local Security Policy console, local security databases, and the Group Policy architecture. This system allows administrators to define password rules, audit capabilities, user privileges, and system access restrictions either directly on standalone machines or hierarchically via Active Directory.

The Local Security Policy Console

On a standalone or workgroup workstation, administrators configure local security using the Local Security Policy Microsoft Management Console (MMC) snap-in, accessible by running secpol.msc. This interface is a subset of the broader Group Policy snap-in tailored exclusively to the local computer.

The console organizes settings into distinct functional categories:

  • Account Policies: Configures password parameters (history, age, length, complexity) and account lockout thresholds.
  • Local Policies: Controls the Audit Policy (tracking logons, object access, and system events), User Rights Assignment (authorizing tasks such as logging on locally, taking ownership, or shutting down the system), and Security Options (restricting access to CD-ROMs, floppy drives, or enforcing legal notices at logon).
  • IP Security Policies (IPSec): Defines rules for secure, encrypted network traffic on the local interface.
  • Public Key Policies: Manages Encrypted File System (EFS) recovery agents and trusted certificates.

Storage and the Security Configuration Engine

Windows 2000 stores local security settings in a dedicated database located at %SystemRoot%\Security\Database\secedit.sdb.

The Security Configuration Engine (SCE) is the underlying mechanism responsible for applying and enforcing these settings. When an administrator modifies a setting in the GUI, the change updates secedit.sdb. The SCE can also be manipulated directly using the command-line utility secedit.exe, which allows administrators to apply, analyze, and export security templates (.inf files) to the local database programmatically.

Precedence in Domain Environments

When a Windows 2000 Professional client joins an Active Directory domain, the Local Security Policy settings are integrated into the Group Policy hierarchy. Windows 2000 processes policies in a strict sequence:

  1. Local Policy (the settings stored on the workstation)
  2. Site Policy
  3. Domain Policy
  4. Organizational Unit (OU) Policy

In this model, any setting defined at the domain or OU level automatically overwrites conflicting settings configured in the workstation's local policy. For example, if a local workstation sets a minimum password length of six characters, but the Domain GPO mandates eight characters, the SCE applies the domain rule.

Policy Refresh and Enforcement

The operating system continuously enforces security policies. In Windows 2000, client workstations poll the domain controller for updated policy settings every 90 minutes by default, with a randomized offset of up to 30 minutes to prevent network congestion. Standalone machines reapply their local settings during system boot and user logon, ensuring that manual alterations to system files or registry keys that conflict with the defined security policy are reverted.