Security Templates Define and Enforce the Rules

For example, when you upgrade a Windows 9x system to Win2K, the upgraded system has all the default settings of a new Win2K system. However, when you upgrade an NT 4.0 system to a Win2K DC, setup doesn't change the NT security settings or system root ACLs. If you want the Win2K DC you upgraded from NT to have the same settings as a new Win2K DC, apply the basicdc template. If you want your upgraded Win2K DC to conform to the more restrictive settings of a secure DC, you must also apply the securedc template. The securedc template adds to but doesn't include controls in the basicdc template. In other words, built-in templates are incremental, not all-inclusive. (For more information about incremental templates, see the Web-exclusive sidebar "How Incremental Templates Work," InstantDoc ID 23083.)

Security Configuration and Analysis
The Security Configuration and Analysis snap-in configures and analyzes the local system by using a security template as a guide. The analysis effectively audits the local system against settings defined in a template, while the configuration component applies the template settings to the local system. If you plan to assign security templates to systems through Group Policy (e.g., to a group of systems or all systems in a domain or an organizational unit—OU), you need the Security Extensions to Group Policy snap-in. . . .