gpedit.msc as centralized policy for 2k/xp clients in domain

[John Newhouse]

I found this from http://charon.minilab.bdeb.qc.ca/anonym/nt/2000/ads/TTGW2KGP_Vol1through4.pdf

I would like to figure out how to do this gpedit.msc+AD+gpc+gpt magic for win2k/xp with
linux+samba(2.2/3.0/tng)+openldap and is it possible at all?

Thanks.

Although GPOs provide significantly more policy features than NT 4.0
System Policy provides,
GPOs are stored and processed differently than NT 4.0 System Policy is.
In NT 4.0, the System
Policy file (often called ntconfig.pol) is stored in the Netlogon share
on domain controllers
within an NT 4.0 domain. When an NT 4.0 user logs onto a workstation in
an NT 4.0 domain,
the system reads the System Policy file from the Netlogon share, then
sets registry values that are
specific to a computer, user, or user group according to the policy
file. NT 4.0 allows only a
single policy file to be processed at a given time. NT 4.0 System Policy
could apply to a specific
computer (or all computers), a specific user (or all users), or an NT
4.0 domain global group.
In contrast, GPOs are composed of two parts: the Group Policy Container
(GPC), which is stored
within Active Directory (AD), and the Group Policy Template (GPT), which
is stored within the
replicated SYSVOL folder on all AD domain controllers in a domain.
Whereas System Policy is
processed only when a user logs onto an NT 4.0 workstation, GPOs are
processed at both
machine startup (at which point machine-specific policy is processed)
and user logon (at which
point user-specific policy is processed). Again, in contrast to System
Policies, you can define a
virtually unlimited number of GPOs within an AD domain (though
practically speaking, large
numbers of GPOs will take a long time to process). And, whereas System
Policies apply to
individual users, individual computers, and NT security groups, GPOs are
processed only by AD
users and computers. However, AD security groups composed of either
machines or users can
filter GPOs' effects. This filtering capability, in conjunction with the
ability to have multiple
GPOs processed by a given user or computer, can provide much greater
policy flexibility than is
available in NT 4.0. Figure 1.2 shows an example of how you can use
security groups to filter
the effects of a GPO.