Re: GPO special case user account options and inheritance question

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: djc (noone_at_nowhere.com)
Date: 09/29/04 

Date: Wed, 29 Sep 2004 14:58:57 -0400

Thanks Kevin... I'll check out the links you provided as well. I have a
related question though:
When policy is applied to a computer account and effects the machines local
policy when logged on to locally as you stated before in your
clarification... does this local policy still take effect when the machine
is not connected (physically unplugged) to the network?

thanks agian.

"Kevin Sullivan" <ksullivan@autoprof.com> wrote in message
news:Oj$KLBkpEHA.536@TK2MSFTNGP11.phx.gbl...
> 1) you are correct with your first statement. One piece of clarification.
> Account policy configuration applied at any level (OU) below the domain
> level will configure the 'local account policy settings'. This means if a
> computer account is the recipient of the account policy applied at a level
> other than the Default Domain Policy the settings will take affect when
> logging on locally.
>
(http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-u
>
s/Default.asp?url=/resources/documentation/windows/xp/all/reskit/en-us/prdp_
> log_csiq.asp)
> 2) Block policy inheritance should not block the domain level account
> policies. I have not tested this but believe this to be true. I am curious
> if anyone finds different information.
> (http://support.microsoft.com/default.aspx?scid=kb;en-us;255550) I think
one
> main point here is that Domain Controllers behave a bit differently than
> other systems on the network. Since they share the NTDS.dit and there
needs
> to be a mechanism to ensure consistency across these replicas.
>
> HTH
>
> Kevin
> AutoProf
> http://www.autoprof.com/policy
>
> "djc" <noone@nowhere.com> wrote in message
> news:ukthXzipEHA.3668@TK2MSFTNGP15.phx.gbl...
> > I understand that account options like password policies, and account
> > lockouts, etc... configured at the domain level are the only user
account
> > policies actually applied... meaning if a lower level container had a
> > conflicting policy configured it would not change the domain level
one...
> >
> > 1) please correct me if I'm wrong with my statement above
> > 2) if a lower level container has the Block Policy Inheritance option
set
> > will the domain level user account policies still be applied? or would
the
> > Block Policy Inheritance actually block them?
> >
> > any info is appreciated... thanks.
> >
> >
>
>

Relevant Pages

  • Re: GPO causing client security logs to fill?
    ... a virus in play. ... settings to be applied on your client workstations. ... Group Policy is a complex and often misunderstood beast. ... I modified the account ...
    (microsoft.public.windows.server.sbs)
  • Re: The local policy of this system does not permit you to logon i
    ... Security policies were propagated with warning. ... Error 0x534 occurs when a user account in one or more Group Policy objects ... I have checked the security policies & the administrator profile is not ...
    (microsoft.public.windows.server.sbs)
  • Re: GPO causing client security logs to fill?
    ... Unlink the Default Domain Controller Policy (As it was not previously ... settings to be applied on your client workstations. ... I modified the account ... So basically, the Account lockout threshold, account lockout ...
    (microsoft.public.windows.server.sbs)
  • Re: GPO causing client security logs to fill?
    ... Possibly delete the Default Domoan Controller Policy (As it did not ... issues as it was about recoverying from a virus which appears to ... with client logon failures. ... I modified the account ...
    (microsoft.public.windows.server.sbs)
  • Re: Password expires for no apparent reason
    ... policy that has set the values to what you see below meaning that users ... So I would define the password age and configure a value in there. ... As Harj said Account lockouts could potentially be a problem as perhaps ... Password expires for no apparent reason ...
    (microsoft.public.windows.server.active_directory)