Local security policy settings - secedit

Archived from groups: microsoft.public.win2000.security, microsoft.public.windows.server.active_directory, microsoft.public.windows.server.general, microsoft.public.windows.server.scripting, microsoft.public.windows.server.security (More info?)

Hello,

I am trying to export local security settings using secedit on windows
2003.

secedit /export /cfg local.inf /log local.log
secedit /export / mergedpolicy /cfg merged.inf /log merged.log

My understanding is the first call gives local settings even if the
server is connected to domain and domain policy settings are
overriding.

Second command gives the merged polices from domain based GPOs. The
number of settings are differenr in both cases, but the values always
seems to be domain values.

Example: If I have minimum password length set to 8 chars on local and
10 chars on domain, both the above commands gives 10 chars.

I take the server out of domain (make it a stand alone server) then I
get a value of 8 on both cases.

Any one else see this behavior? How do I dump settings from local
secedit.sdb?

Thanks

Ravi