diff --git a/packages/windows/assembly/NTMakefile b/packages/windows/assembly/NTMakefile
index 3bc2207ae..9f906b6bd 100644
--- a/packages/windows/assembly/NTMakefile
+++ b/packages/windows/assembly/NTMakefile
@@ -159,6 +159,59 @@ $(APPMANIFEST): Heimdal.Application.manifest.in
 test::
 	$(MT) -manifest $(APPMANIFEST) -validate_manifest
 
+# ----------------------------------------------------------------------
+# Publisher configuration files
+
+POLKRB=policy.$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).Heimdal.Kerberos
+POLKRBDIR=$(ASMDIR)\$(POLKRB)
+POLKRBFILE=$(POLKRBDIR)\$(ASMKRBVER).pol
+POLKRBCAT=$(POLKRBDIR)\$(ASMKRBVER).cat
+
+$(POLKRBFILE): policy.Heimdal.Kerberos.in
+	$(SED)  -e "s,[@]krbname[@],$(ASMKRBNAME),g"	\
+		-e "s,[@]krbversion[@],$(ASMKRBVER),g"	\
+		-e "s,[@]krbverfrom[@],$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR),g"	\
+		-e "s,[@]krbpolname[@],$(POLKRB),g"	\
+		-e "s,[@]cpu[@],$(MCPU),g"	\
+		-e "s,[@]pkt[@],$(CODESIGN_PKT),g" < $** > $@
+
+$(POLKRBFILE).cdf: $(POLKRBFILE)
+	$(MT) -manifest $(POLKRBFILE) -makecdfs
+
+$(POLKRBCAT): $(POLKRBFILE).cdf
+	cd $(POLKRBDIR)
+	$(MAKECAT) $**
+	$(_CODESIGN)
+	cd $(SRCDIR)
+
+POLGSS=policy.$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).Heimdal.GSSAPI
+POLGSSDIR=$(ASMDIR)\$(POLGSS)
+POLGSSFILE=$(POLGSSDIR)\$(ASMGSSVER).pol
+POLGSSCAT=$(POLGSSDIR)\$(ASMGSSVER).cat
+
+$(POLGSSFILE): policy.Heimdal.GSSAPI.in
+	$(SED)  -e "s,[@]gssname[@],$(ASMGSSNAME),g"	\
+		-e "s,[@]gssversion[@],$(ASMGSSVER),g"	\
+		-e "s,[@]gssverfrom[@],$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR),g"	\
+		-e "s,[@]gsspolname[@],$(POLGSS),g"	\
+		-e "s,[@]cpu[@],$(MCPU),g"	\
+		-e "s,[@]pkt[@],$(CODESIGN_PKT),g" < $** > $@
+
+$(POLGSSFILE).cdf: $(POLGSSFILE)
+	$(MT) -manifest $(POLGSSFILE) -makecdfs
+
+$(POLGSSCAT): $(POLGSSFILE).cdf
+	cd $(POLGSSDIR)
+	$(MAKECAT) $**
+	$(_CODESIGN)
+	cd $(SRCDIR)
+
+all:: $(POLKRBFILE) $(POLGSSFILE) $(POLKRBCAT) $(POLGSSCAT)
+
+clean::
+	-$(RM) $(POLKRBDIR)\*.*
+	-$(RM) $(POLGSSFILE)\*.*
+
 # ----------------------------------------------------------------------
 
 .SUFFIXES: .dll .pdb
@@ -170,4 +223,9 @@ mk-asm-dirs:
 !  if !exist($(ASMGSSDIR))
 	$(MKDIR) $(ASMGSSDIR)
 !  endif
-
+!  if !exist($(POLKRBDIR))
+	$(MKDIR) $(POLKRBDIR)
+!  endif
+!  if !exist($(POLGSSDIR))
+	$(MKDIR) $(POLGSSDIR)
+!  endif
diff --git a/packages/windows/assembly/policy.Heimdal.GSSAPI.in b/packages/windows/assembly/policy.Heimdal.GSSAPI.in
new file mode 100644
index 000000000..448cb1851
--- /dev/null
+++ b/packages/windows/assembly/policy.Heimdal.GSSAPI.in
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity type="win32-policy"
+                    publicKeyToken="@pkt@"
+                    name="@gsspolname@"
+                    version="@gssversion@"
+                    processorArchitecture="@cpu@"/>
+  <dependency>
+    <dependentAssembly>
+      <assemblyIdentity type="win32"
+                        publicKeyToken="@pkt@"
+                        name="@gssname@"
+                        language="*"
+                        processorArchitecture="@cpu@"/>
+      <bindingRedirect oldVersion="@gssverfrom@.0.0-@gssversion@"
+                       newVersion="@gssversion@"/>
+    </dependentAssembly>
+  </dependency>
+</assembly>
diff --git a/packages/windows/assembly/policy.Heimdal.Kerberos.in b/packages/windows/assembly/policy.Heimdal.Kerberos.in
new file mode 100644
index 000000000..12f9f3c2b
--- /dev/null
+++ b/packages/windows/assembly/policy.Heimdal.Kerberos.in
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity type="win32-policy"
+                    publicKeyToken="@pkt@"
+                    name="@krbpolname@"
+                    version="@krbversion@"
+                    processorArchitecture="@cpu@"/>
+  <dependency>
+    <dependentAssembly>
+      <assemblyIdentity type="win32"
+                        publicKeyToken="@pkt@"
+                        name="@krbname@"
+                        language="*"
+                        processorArchitecture="@cpu@"/>
+      <bindingRedirect oldVersion="@krbverfrom@.0.0-@krbversion@"
+                       newVersion="@krbversion@"/>
+    </dependentAssembly>
+  </dependency>
+</assembly>
\ No newline at end of file