Configuring and Using International Features of Windows

On This Page

	Overview
	Applying MUI Group Policy to a Local Computer
	Applying MUI Group Policy to Active Directory Container Objects
	Applying MUI Group Policy to individual users within Active Directory containers
	Further Reading

Overview

The Menus and dialogs language in the Windows MUI

A new feature introduced in the Windows MUI allows users to change the language used to display the operating system's menus and dialogs. Through the Menus and dialogs control in the Regional Options control panel, users can select any one of the user interface languages installed on the machine.

Allowing each user to switch the user interface language to any one of the installed languages may be undesirable in some environments. The MUI Group Policy allows administrators to restrict groups of users, or individual users, to the use of one particular language rather than all the languages installed on a machine.

MUI Group Policy

MUI Group Policy is a Windows Group Policy that restricts specified user(s) to the use of one designated language, and disables the Menus and dialogs control in the Regional Options control panel, ensuring that the system cannot be switched to another language.

This policy is expected to be useful in situations where:

MUI Group Policy leverages the power of the Windows 2000 Active Directory and Group Policy technology to offer administrators a great deal of flexibility when planning and maintaining desktop configurations. The policy allows an administrator to set different user interface languages for each site, domain or organizational unit, and to apply the effects to individual users through the use of security groups and Access Control Lists.

How MUI Group Policy is administered

MUI Group Policy is a registry-based policy. It is administered in the Group Policy Snap-in of the Microsoft Management Console, and is listed in the User Configuration node under:

Administrative Templates | Control Panel | Regional Options: "restrict selection of Windows 2000 menus and dialogs language".

Top of page

Applying MUI Group Policy to a Local Computer

Requirements

This section assumes you have at least:

•	one computer running Windows MUI.

Note: The effect of applying MUI Group Policy to a local computer. Group Policy is applied to a local computer through the use of Local Group Policy Objects (LGPOs). LGPOs are stored on the local machine rather than in the Active Directory, and their scope is therefore limited to users of that machine. Because LGPOs affect all users of a machine, there is no way to filter the effects to individual users. Applying MUI Group Policy to the machine will restrict every user to the one language specified in the policy. Although this effect may be desirable in certain situations ¹, you may want to consider applying the policy to Active Directory Objects, rather than LGPOs, if you need finer control over the effects of the policy.

Step-by-step: Applying MUI Group Policy to a local computer

Click on the reduced graphic to see the full-size version

1.	Open the Microsoft Management Console. (Type mmc from the run command or the command prompt.)
2.	Click the Console menu, and click Add/Remove Snap-in...
3.	Click Add? on the Standalone tab to add a standalone Snap-in
4.	Ensure Local Computer is selected in the Group Policy Object field. Click Finish. (Note: You can use the Browse button to select a remote machine on which the GPO should be stored and applied.)
5.	In the Group Policy Snap-in, expand the User Configuration node to Administrative Templates | Control Panel | Regional Options. Double-click to open the Restrict selection of Windows 2000 menus and dialogs language policy.
6.	In the Group Policy Snap-in, expand the User Configuration node to Administrative Templates | Control Panel | Regional Options. Double-click to open the Restrict selection of Windows 2000 menus and dialogs language policy.

Top of page

Applying MUI Group Policy to Active Directory Container Objects

Requirements

This section assumes you have at least:

•	a pre-configured domain, with organizational units, users and groups already established, as per your requirements
•	one Windows 2000 Server configured as a Root Domain Controller (running Active Directory services)
•	one system running Windows MUI, with an account in the Active Directory domain
•	administrative privileges on the Root Domain Controller
•	a working knowledge of basic Active Directory concepts, such as objects and containers

Note: Applying MUI Group Policy to Objects in the Active Directory. Applying the MUI Group Policy to Active Directory sites, domains and organizational units allows you to control the menus and dialogs languages used by users across a network. The policy, like all Group Policies, is administered within the Active Directory through the use of the Active Directory Users and Computers management console and the Group Policy Snap-in. Using these tools, policy can be applied to sites, domains and organizational units, and will affect all the objects they contain (including users and computers). Note that it is impossible to apply policy directly to a user. A policy applied to an OU will affect all users contained within that OU. A later section of this walkthrough explains how to filter the effects of the MUI Group Policy so that certain users are unaffected by a GPO.

Planning considerations

By default, Group Policy is inherited from far to near through the domain tree. Policy applied to high level container objects will be inherited by lower level objects, and policy applied to lower level containers will override that applied at a higher level ².

With this in mind, it’s important to carefully plan the use of the MUI Group Policy. Applying the policy too far up the domain tree will result in an entire organization being restricted to the same single language for menus and dialogs! As with all Group Policies, it is a good idea to be as specific - and as local - as possible when applying the MUI Group Policy.

Step-by-step: Applying MUI Group Policy to Active Directory Container Objects

Click on the reduced graphic to see the full-size version

1.	Open the Active Directory Users and Computers management console (from the Administrative Programs control panel, or by opening a standalone Snap-in using the same procedure followed for the Group Policy Snap-in) Expand the Domain and OU nodes to display the objects to which the policy is to be applied.
2.	Right-click the container object to which the policy is to be applied. Click Properties. (In this example the domain object has been selected. By default, the policy applied here will be inherited by the lower level organizational units.)
3.	In the object’s Properties Page, click the Group Policy tab. Click New (or right-click, then click New) to create a new Group Policy Object. Name the GPO. Click Edit to launch the Group Policy Snap-in.
4.	In the Group Policy Snap-in, expand the User Configuration node to Administrative Templates | Control Panel | Regional Options. Double-click to open the Restrict selection of Windows 2000 menus and dialogs language policy.
5.	Enable the policy by selecting the Enabled radio button. Select the language to which objects in the container should be restricted. (Note: If the language selected is not installed on a target machine, the selection will default to English.) Click OK. Close the Group Policy Snap-in.

Top of page

Applying MUI Group Policy to individual users within Active Directory containers

Requirements

This section assumes you have at least:

Planning considerations

Organizational Units are the smallest Active Directory containers to which Group Policy can be applied. Once a policy has been applied to an Organizational Unit, it will affect all users in that Organizational Unit, unless the effects are filtered.

To filter the effects of the MUI Group Policy to individual users within an Organizational Unit (or any other container), it is necessary to modify the user membership in Security Groups, and use Access Control Entries (ACEs) to specify whether or not the Group Policy is applied to the groups.

Determine those users who should be allowed to use more than one user interface language, and those who should not. Then create appropriate Security Groups to contain those users, and set the Apply Group Policy ACE to the Security Groups accordingly.

By changing which groups have what ACE applied, administrators can customize how any GPO affects the users or computers subject to a GPO. Write access is required for modifications to be made; Read and AGP ACEs are required for a policy to affect a group.

Use Deny with caution. A Deny setting for any group has precedence over any Allow given to a user or computer because of membership in another group. Further details may be found in the resources listed at the end of this document.

Step-by-step: Applying MUI Group Policy to individual users

Click on the reduced graphic to see the full-size version

Note: Using Security Groups and ACEs provides administrators with a great deal of flexibility when filtering the effects of Group Policy to users. The following step-by-step guide demonstrates just one of the many possible ways of configuring and using MUI Group Policy to restrict the user interface language of individual users.

The steps involved in applying MUI Group Policy to individual users are:

1.	Open the Active Directory Users and Computers Management Console Open the Active Directory Users and Computers Management Console (from the Administrative Programs control panel, or by opening a standalone Snap-in using the same procedure followed for the Group Policy Snap-in)
2.	Create a New Security Group Create a New Group by right-clicking on the container in which you wish to create the group, and selecting New…Group. In this example the group is being created in the Users container.
3.	Give the new group a name. Ensure the Group scope is “Global” and the Group type is “Security". Click OK. Here the group is called Non multilingual users. In this example this group will contain users from a German Product Support Office who should be restricted to the use of the German user interface language.]
4.	Add members to the new security group Open the property sheet of the new group by right-clicking on the group’s name and selecting Properties.
5.	Select the Members tab and click the Add button to add members to the group.
6.	Select the users to add to the group by clicking on them. Click Add. When all the necessary users have been added, click OK. In this example three users from the German Product Support Office Organizational Unit have been added to the group. These three users are to have their choice of user interface language restricted to German.
7.	Apply the MUI Group Policy to the Active Directory Container Object Open the property sheet for the Active Directory container in which the GPO is to be stored. In this example the MUI Group Policy is to be applied to the German Product Support Office.
8.	Select the Group Policy tab. Click New to create a new Group Policy Object. Name the GPO. Click Edit to launch the Group Policy Snap-in.
9.	In the Group Policy Snap-in, expand the User Configuration node to Administrative Templates | Control Panel | Regional Options. Double-click to open the Restrict selection of Windows 2000 menus and dialogs language policy.
10.	Enable the policy by selecting the Enabled radio button. Select the language to which the non multilingual users should be restricted. (Note: If the language selected is not installed on a target machine, the selection will default to English.) Click OK. Close the Group Policy Snap-in. In this example the MUI Group Policy has been set to German. At this point, the policy will have the effect of restricting all users of the German Product Support Office Organizational Unit to the German user interface language.
11.	Add the new Security Group to the Active Directory Container Object Select the Group Policy Object. Open the property sheet for the GPO by clicking the Properties button.
12.	Select the Security tab. Click Add….
13.	Select the security group created earlier in steps 2 & 3. Click Add…. In this example, the new Non multilingual users Group is added to the container.
14.	Set the permissions for each of the Security Groups in the Active Directory Container Object Select each group and check the permission set on the Apply Group Policy ACE. Ensure Apply Group Policy is neither allowed nor denied for the Authenticated Users group. This will prevent the Group Policy from being applied to members, unless they belong to another group to which the policy is applied. Ensure Apply Group Policy is set to Allow for the Non multilingual users group. This will ensure the members of this group have the policy applied to them. Click OK. In this example, users in the German Product Support Office Organizational Unit do not have the ui language=German policy applied to them unless they belong to the Non multilingual users group.

Top of page

Further Reading

Top of page

12 of 14