Re: Domain Security Policy Versus Domain Controller Security Policy



Shane wrote:

> Can someone please give me a clear definition of the difference between
> Domain Security Policy Versus Domain Controller Security Policy. I'm setting
> up Audit Policy's and I've set up the same Audit Policy's in Domain Security
> Policy and Domain Controller Security Policy. Do I need to setup Audit
> Policy's in both the Domain Security Policy and Domain Controller Security
> Policy? Am I duplicating event id's?
>
> Thanks,

Domain policies are applied before individual OU policies. An OU policy is the
last one to be applied (but you can have multiple OUs and multiple policies per
OU). You aren't duplicating events messages because (among other reasons) the
policy settings are additive and the last policy that modifies a setting is the
one that sticks so defining a setting to have a certain value more than once just
means it takes longer to process the settings.

The Domain Controller policy exists to allow you to give special policy settings
to your domain controllers that are independent of the rest of your servers and
workstations. If you don't really need anythign special defined for your domain
controllers then the domain policy will suffice however most people at least want
certain services not needed on th domain controllers to be turned off but the
same ones left on for workstations so the settings for those services in teh
domain policy would need to be overridden by settings in the domain controller
policy.


hope that helps




.

Relevant Pages

  • Re: GPO not picking up computer settings
    ... settings to undefined in default domain policy. ... run the command net accounts to see if it is what you expect. ... If "block inheritance" is enabled on the domain controller container ...
    (microsoft.public.windows.server.security)
  • Re: Domain
    ... Domain Controller Security Policy has all user rights assignments ... Configuring ipsec policy at the domain level ...
    (microsoft.public.win2000.group_policy)
  • Re: Default Domain Controllers Policy ISSUE!!!
    ... GPO's for the Default Domain Controller Security Settings and need help fast. ... Controllers Policy GPO. ...
    (microsoft.public.windows.server.sbs)
  • Re: Group policy - another newbie question
    ... Domain Controller Security Policy is exactly that. ... > settings you see if you open Active Directory ...
    (microsoft.public.win2000.group_policy)
  • Re: Domain Security Policy vs Domain Controller Security Policy
    ... Does Domain Controller Security ... > Policy just effect the DCs and Domain Security Policy effect the whole ... > domain which includes the DCs? ...
    (microsoft.public.win2000.security)