Windows Registry creating users

From the Microsoft Help & Support article entitled:

File security issues after converting FAT32 partitions to the NTFS file system

The default permissions for the "All Users" folder within the "Documents And Settings" folder should be:

With a manual installation of Windows XP Professional or Windows XP Home Edition, the default permissions of the All Users folder and all the subfolders that have inheritable permissions are as follows:

• Administrators: All items (including Full Control) are selected.
• Everyone: Read and Execute, List Folder Contents, and Read are selected.
• Power Users: All items except Full Control are selected.
• System: All items (including Full Control) are selected.
• Users: Read&Execute, List Folder Contents, and Read are selected.

Local Group Policies get stored outside of the registry in C:\Windows\System32\GroupPolicy and get merged into the registry during startup (for computer policies) or logon (for user policies). You need to view them as a separate entity which need not actually even exist for a setting to take effect.

When you view the local policy in gpedit.msc what you're viewing is what is in the C:\Windows\System32\GroupPolicy folder, not what's currently in the registry.

One suggestion would be to modify the local policy to taste on a test machine and drop the relevant files onto your other machines, but I haven't tested this and can't confirm it would work. Overall though I honestly think you're better off biting the bullet and putting Windows Domain Controllers in. You may be saving money on license fees with your current approach, but you're just losing a whole lot of time on maintaining an elaborate (and potentially delicate) setup that using Windows DCs would totally bypass. Unfortunately I suspect that the cost of the time you're losing would be multiples of the cost of just implementing Windows DCs.