Re: Group Policy - Password

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

On Mar 28, 5:28 pm, aja44 <aj...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Florian,

Hi there.  I was looking through the Group Policy section and came across
this thread.  Just wanted to confirm that what the original post was stating
was there he had created a new GPO for the domain passwords above the Default
Domain Policy.  Is it not true that you can only have one (1) Password Policy
per domain and it will Always come from the Default Domain Policy?  The
Default Domain Controller Policy is configured to pull Password related
settings from the Default Domain Policy.  How can you configure a domain to
have multiple password policies?  I thought that was the main reason for
having to create Child Domains with 2000 and 2003 AD.

Thanks in advance for clarifying.



"Florian Frommherz [MVP]" wrote:
Howdie!

Robbie schrieb:
We have an issue were the password policy has been set to 120 days renewal,
however our users and being prompted at 30 days. We suspect this is the
default policy. Currently we have a Windows 2003 native environment with two
root policies, one the default and the second which is our working policy.
The working policy is above the default and should take effect first. The
default policy has nothing changed within it.

So your custom policy that *shall* be applied is shown above the Default
Domain Policy? Is inheritance blocked at the Default Domain Controllers OU?

cheers,

Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog:http://www.frickelsoft.net/blog.- Hide quoted text -

- Show quoted text -

Hi,

The password settings do not have to be in the default domain policy
per say.
They must be in a policy linked at the domain level with the HIGHEST
priority and that it applies to the the domain controllers
Until 2008 the only way to have multiple password policies is to
create new domains or utilize third party password filters.

Good Luck

Harj Singh
Password Policy done right
www.specopssoft.com
.

Relevant Pages

  • Re: Intermittant GPO failure to apply
    ... If you have backup your group policy before, you can restore it from the ... 244474 How to force Kerberos to use TCP instead of UDP in Windows Server ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Set GPO for specific user group
    ... Click on the domain name in Group Policy Management, select the GPO and then click the arrow to the left to move it to the top of the list ... Filtering: Denied ...
    (microsoft.public.windows.server.sbs)
  • RE: Remote Assistance not working
    ... I have tried these settings you recommend with no results. ... I have yet to get the offer remote assistance to work when launched from the ... The Group Policy on the computer of the novice user must be configured ... Start the Microsoft Management Console Group Policy snap-in. ...
    (microsoft.public.windows.server.sbs)
  • Re: GPOs and Security
    ... Policy info that you may find helpful. ... 250842 Troubleshooting Group Policy Application Problems ... 247811 How Domain Controllers Are Located in Windows ...
    (microsoft.public.win2000.security)
  • RE: Group Policy Connundrum - Stick with it, its confusing!!!
    ... Group Policy Connundrum - Stick with it, ... Small Business Server Internet Connection Firewall ... Import the current Content Ratings Settings: ...
    (Security-Basics)