Re: Password Policy & GPO Settings

From: Veets (dddetrretsssadasy_at_hotnospmamail.com)
Date: 07/21/04 

Date: Wed, 21 Jul 2004 16:57:41 -0400

Thanks Paul, that makes sense. Guess I should have scrolled down a bit to
see the post by Sunnie entitled 'Group Policy question...' :)
Thanks again
Regards,
Veets

"Paul Bergson" <pbergson@mnpower.com> wrote in message
news:eqxm5G2bEHA.3636@TK2MSFTNGP09.phx.gbl...
> User account password policy settings are only applied at the domain
level.
>
> Default Domain Policy / Computer configuration / windows settings /
> security settings / account policies / password policy
>
> If you go to an ou below the domain ou and define / Computer
configuration
> / windows settings / security settings / account policies / password
policy
> it won't be applied to a domain account
>
>
> --
>
> Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>
>
> "Veets" <dddetrretsssadasy@hotnospmamail.com> wrote in message
> news:uGTIiqzbEHA.1644@tk2msftngp13.phx.gbl...
> > Hello,
> > We're running a Windows 2000 domain & I have a few questions about the
> > domain password policy settings.
> > I'm familiar with the GPO inheritance order -> Local -> Site -> Domain
> > GPO -> OU
> > I've read however, that you can only have 1 password policy setup for
your
> > domain which is defined at the default GPO (I read it in the following
> > article ->
> >
>
http://www.microsoft.com/smallbusiness/gtm/securityguidance/articles/enforce_strong_passwords.mspx)
> >
> > As far as I understand it, what this means is that even if you define a
> new
> > password policy on an OU, it will not work since the OU will 'pick up'
the
> > default GPO password settings? Is this correct? Also, will the default
GPO
> > settings override the 'Account Lockout Policy' & 'Event Log' options of
> the
> > new OU as well?
> > If I'm right, does this mean that I'll need to create a new domain to
get
> > around this problem?
> > I hope my questions are clear enough.
> > Any input is greatly appreciated. TIA
> > Best regards,
> > Veets
> >
> >
> >
>
>

Relevant Pages

  • Re: Access denied to Control Panel applets!
    ... indicate a GP is applying those restrictions to his user account. ... Group Policy was applied from: ... that much - nothing for the control panel etc... ...
    (microsoft.public.windowsxp.security_admin)
  • Re: unable to change the default email address for an account
    ... Open the properties for the user account. ... clear " Automatically update email address based on Recipient Policy ... BTW, my mistake, the default policy priority is marked as 'Lowest' not 0. ... Les Connor [SBS Community Member - SBS MVP] ...
    (microsoft.public.windows.server.sbs)
  • Re: Problem when creating news users
    ... Les Connor [SBS Community Member - SBS MVP] ... No there was no system policy listed. ... Entering the Template Committer... ... User account: Klazina created successfully. ...
    (microsoft.public.windows.server.sbs)
  • Re: Default Domain Policy - Password Policy
    ... Is there a way to find the value of domain users' pwdLastSet? ... I will change the Maximum Password Age = 365. ... last set for each user account. ... is there a domain-wide policy setting to expire all ...
    (microsoft.public.windows.server.active_directory)
  • Re: Access denied to Control Panel applets!
    ... Policy settings are applied again so that they will show up in the ... user account though you may need to logon as an administrator when done to ... show that much - nothing for the control panel etc... ...
    (microsoft.public.windowsxp.security_admin)