Policy management vendor FullArmor this week is expected to introduce software that will extend the ability to centrally manage settings on Microsoft desktops and servers to computers routinely disconnected from corporate networks and those networks not running Microsoft's Active Directory.

The company's GPAnywhere extends the abilities of Microsoft's group policy technology, which is supported on Windows 2000, XP and Windows Server 2003. Group policy works in conjunction with Active Directory and lets administrators manage, customize and lock down desktop and server settings based on a set of policies maintained in the directory. For example, the policies could prevent users from installing software or changing settings. They also can disable services such as USB ports to prevent the use of removable storage devices.

GPAnywhere also provides group policy features to networks that do not run Active Directory or are in the process of migrating to the platform.

"FullArmor is taking a local policy and making it manageable," says Michael Silver, an analyst with Gartner. "If I use local policy without Active Directory I have no way to manage it. I have no way to make sure it is applied. And if I apply a local policy and the end user has administrative rights, they can bypass the policy. With FullArmor you can distribute the policy and prevent administrators from altering it."

GPAnywhere allows laptops, mobile devices and kiosks to be managed using group policy even though those machines are rarely or intermittently connected to the directory.

It also can help users migrating from NT or other platforms to implement group policy, using the GPAnywhere templates on desktops and servers before deploying Active Directory.

The software has three components that let administrators create executable files and load them onto desktops.

The Policy Template Designer plugs into Microsoft's Group Policy Management Console and includes a number of templates that can be packaged into executable files. Users also can build their own templates or integrate the Designer with FullArmor's IntelliPolicy for Clients, which adds 100 group-policy objects on top of those Microsoft provides. The Policy Dispatcher is used to distribute the policies via Microsoft's System Management Server, Remote Installation Service or other deployment software. The Policy Enforcer sits on client machines and enforces policies. It gives users with administrative rights, such as help desk staff, a small set of capabilities to manage local templates.