Fixed!
I have no idea what caused this error, but it eventually went away. I think it was when I installed other roles first (maybe Application, can't quite remember). It's certainly a weird bug! But I do have NPAS installed on my 2008 machines now, so it worked in the end.
Sorry that's not anymore help :(
I'm in a similar position, except we've got nearly 50 machines. I'd like to be able to do everything with Group Policies. This does however REQUIRE a Windows Domain Controller.
Look at the costs involved. Your time to manage the network is expensive, whereas the amount of time you could save, and be working on other projects which are more beneficial to your employer, is much more valuable. (I'm assuming here that you're not a dedicated desktop support guy)
So, a pair of domain controllers, say from HP: DL320 4GB RAM will be more than adequate. £899.00 ex VAT each.
Then Windows Server 2008 R2 - £474.00 ex VAT
Total cost is just shy of £3000
Yes, you need 2. These are going to run your network authentication, without Domain Controllers, your network will rapidly go south. It's a small cost for a massive piece of mind.
And then you'll be ready to manage your growing windows network a lot more robustly than you can with Ubuntu and Samba. I'm all for open-source, but not when it comes to managing windows networks. I've been there personally, with Slapd and Samba, and openldap schemas, and let me put it like this. It's really not worth your time.
Best Answer
The Remote Server Administration Tools for Windows Server 2008 R2 do not include the MMC snap-in for managing the Network Policy Server; the snap-in is installed only on servers where the NPS role is actually enabled.
From a server which has the NPS role enabled, you can run
mmc.exe, add the NPS snap-in to it and have it connect to a remote server; but you can't do the same from a computer which has only the RSAT package but not the NPS role.