Re: Domain Security policy

In news:78CF92CC-204A-4C13-B1E6-A50634B05DB4@xxxxxxxxxxxxx,
DD <DD@xxxxxxxxxxxxxxxxxxxxxxxxx>, posted the following:
i onlu have one default policy for the domain, how to create
addtional domain policy ,also want to create different dept have
different group policy. i am new in windows server, can yu provide me
some usefully link .


"DD" wrote:

I made changes on the domain policy , but it does not apply to user
pc when they login.

eg , i allowed change the system time for a specific user. when i
login to the user pc, from the local policy, chnage the system time,
only show administrator can change not the specific user.

Hi DD,

It's suggested and recommended to not change the Default Domain Policy. Keep in mind, whatever you set at the domain level, flows downhill to everything. I would suggest to design your OU structure to reflect your organizaiton and/or departments, which will also help you create GPOs for the OU design.

For example, for a company with more than one location/site, I would suggest the following:

Domain
......Philly OU
...............Accounting
...............Sales
...............Marketing
...............Desktop
...............Users
...............Laptops
......Seattle OU
...............Accounting
...............Sales
...............Marketing
...............Desktops
...............Users
...............Laptops

I separated Laptops and Desktops because I have two different Windows Update GPOs set. The Desktop Windows Update GPO I created runs at 3:00 AM, whereas the Laptop Updates run at 3:30 PM while the users have the laptops in the office. This design also allows me to create GPOs for the different offices, or I can create one and link them to both offices. The design possibilities are endless, especially if you control flow with Block Inheritance, Loopback, WMI filtering, disabling the Computer or User portion of a GPO, etc, however in many cases I do not use these features because trying to support them 8 months later when there's a problem it is difficult to remember what you had blocked, etc. Yes youcan use RSOP to look at what is being applied, etc, but I find it easier to simply create another OU or a child OU to have a different setting than the parent, such as the following, where I created a GPO to lock the desktop with two different time settings. The Desktops OU has a 30 minute setting, but I created a 15 Minute Timeout OU directly beneath it. Because the identical setting isdifferent on the child, it overrides the parent's setting. I can simply "look" at my OUs and know what I have applied.

......Seattle OU
...............Accounting
...............Sales
...............Marketing
...............Desktops
.....................15 Minute Timeout
...............Users
...............Laptops

These are just suggestions, and you may find that it may work for you, or not. Even in a single site, I still do it this way, because it is flexible. You never know when the customer or your company may expand. If they do, simply create another OU for the new location.

Here's a basic visual of how GPOs work, and how it would flow downhill.
http://www.fekay.com/supportblogs/gpoflow.jpg

Win2k3 AD OU/GPO Design Discussion
http://www.tomshardware.com/forum/190896-46-win2k3-design-discussion

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
aceman@xxxxxxxxxxxxxxxxxxxxxxx

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.


.

Relevant Pages

  • Re: Users, Groups and Computers - BEst practise?
    ... DELEGATION and LINKING of GPOs. ... You design the OU structure primarily for these two ideas. ... with business units spread over multiple locatins ... say for example NEtwork Services should there be more groups which say: ...
    (microsoft.public.windows.server.active_directory)
  • Re: Question regarding Group Policy appling order
    ... "Meinolf Weber" wrote: ... So your firewall is the first that applies, then domain policy. ... GPOs linked to the OU highest in the Active Directory hierarchy ... I know i mix up computer and user configuration properties in my ...
    (microsoft.public.windows.server.active_directory)
  • Re: GROUP POLICY
    ... Group Policy Objects (GPOs) Design Considerations and Guidelines ... I separated Laptops and Desktops because I have two different Windows Update ...
    (microsoft.public.windows.server.active_directory)
  • Re: Question regarding Group Policy appling order
    ... If i run RSOP for my administrator it displays only once the policies. ... So your firewall is the first that applies, then domain policy. ... GPOs linked to the OU highest in the Active Directory hierarchy are ... I know i mix up computer and user configuration properties in my lab ...
    (microsoft.public.windows.server.active_directory)
  • Re: Question regarding Group Policy appling order
    ... "Meinolf Weber" wrote: ... So your firewall is the first that applies, then domain policy. ... GPOs linked to the OU highest in the Active Directory hierarchy are ... I know i mix up computer and user configuration properties in my lab ...
    (microsoft.public.windows.server.active_directory)
Loading