Re: Block Policy Inheritance not working as anticipated

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: bottomfeeder (bottomfeeder_at_discussions.microsoft.com)
Date: 07/20/04 

Date: Mon, 19 Jul 2004 18:17:02 -0700

Thanks Steve.

"Steven L Umbach" wrote:

> Password/account policy for domain users can only be configured at the domain level,
> and any attempts to bypass it will not work. Think of it as having a permanent no
> override applied to it. You would have to create another domain to have different
> password/account policy. You can configure AD accounts to "not expire" in account
> properties to bypass the password age setting if that helps. --- Steve
>
> http://support.microsoft.com/default.aspx?scid=kb;en-us;255550
>
> "bottomfeeder" <bottomfeeder@discussions.microsoft.com> wrote in message
> news:5CB08C55-1367-4AA8-8950-269A80A927ED@microsoft.com...
> > I have a Domain Controller running Windows 2000 Server. The Domain container
> (root) has a GPO (Default Domian Policy) with password policies defined (complexity,
> history, length and age). Below the Domain container I have 3 OUs (Accounts, Domain
> Controllers and Groups). Only the Domain Controllers OU has it's own GPO (Default
> Domain Controllers Policy). This policy does not have any password policies defined.
> >
> > Below the Accounts OU I have a child OU (EM Mailbox) that contains User accounts.
> I have one GPO set for this OU which does not have any password policies defined. I
> have selected the check box for "Block Policy Inheritance" under the Group Policy tab
> of the EM Mailbox properties.
> >
> > I expected this to block the password policy settings from GPO on the Domain
> Container (root), but it has not worked. On the Domain Controller I have issued the
> following command after selecting the Block Policy Inheritance check box:
> >
> > secedit /refreshpolicy machine_policy /enforce
> >
> > I also restarted the Domain Controller after issueing the secedit command above.
> >
> > I am still unable to create a new user account in the EM Mailbox OU without being
> subject to the password policies set in the GPO associated with the Domain Container
> (root). I need to be able to create the new user account using a password that does
> not meet all the password requirements set in the Domain Container's GPO.
> >
> > Does anyone have any suggestions?
> >
> > Thanks in advance!!
>
>
>

Relevant Pages

  • Re: Default Domain password policy issue
    ... The domain controllers are members of authenticated users. ... as for applied Group Policy objects for computer settings. ... Policy replication/version problems. ... The settings in this GPO can only apply to the following groups, users, ...
    (microsoft.public.windows.group_policy)
  • Re: Using GPO to implement Password Policy
    ... will need need another server to use as a domain controller in order to ... Password, Kerberos, and Lockout policy. ... To use password policies you must use them at the domain level. ... I then attempted to then link this GPO to a test OU, ...
    (microsoft.public.windows.server.active_directory)
  • RE: Group Policy: multiple password policies in the same domain?
    ... I'd suspected that you might be able to use a different GPO at the same level but having never tested it I didn't want to committ it to writing! ... Subject: Group Policy: multiple password policies in the same ... You can only affect domain> accounts at the domain level, but you do NOT have to use the> "Default Domain Policy" GPO. ...
    (Focus-Microsoft)
  • Re: Assign password policy to OU
    ... Password policies defined in the Default Domain Policy GPO apply to ALL ... I created an OU called 'Estimators' and created a GPO called Estimator ...
    (microsoft.public.windows.server.active_directory)
  • Re: Using GPO to implement Password Policy
    ... you will need at least a separate server. ... Password, Kerberos, and Lockout policy. ... To use password policies you must use them at the domain level. ... I then attempted to then link this GPO to a test OU, ...
    (microsoft.public.windows.server.active_directory)