Re: Account policy applied to Sub-Domain

From: Herb Martin (news_at_LearnQuick.com)
Date: 01/27/04 

Date: Tue, 27 Jan 2004 09:32:28 -0600

> I am administering a sub-domain in a tree and am trying to change some of
the Account Policies within the Default Domain Policy (eg. Maximum Password
Age). Unfortunately the changes I make aren't being applied. I believe
this is because the higher level domain is over-riding my settings. Could
this be the case? If so, how can I stop this from happening?

No, because Group Policy inheritance does NOT flow down domain trees.
Group Policy link to a domain affects ONLY that domain.

Are you linking the Group Policy to the DOMAIN you administer? GPO settings
normally work at ANY level but those specific items in "Security\Account
Policies",
(i.e., Password, Lockout, Kerberos) are DOMAIN specific and cannot be set
effectively on OUs or Sites.

(Setting them on a "machine" affects only local machine accounts.) 

-- 
Herb Martin
"Patrick R" <anonymous@discussions.microsoft.com> wrote in message
news:B81E5C62-85A0-4F2B-8C05-5E6CF55D0B5B@microsoft.com...
> Dear All
>
>
> Any help much appreciated.

Relevant Pages

  • RE: 2003 Logon Audit Problem
    ... its under Domain Controller Security Policy, then that same tree.. ... > Audit account logon events ...
    (microsoft.public.windows.server.general)
  • Re: Cutting tree near electricity cables
    ... I indeed work for an electricity company - customer services - dealing daily ... In our area there is a policy that if a cable is running through trees etc ... doing at no cost to the person whose property the tree is situated. ...
    (uk.rec.gardening)
  • Re: OT - tornado survivors
    ... Our policy will pay damage to structure and removal of a tree IF ... If a tree is not actually ON a structure (in ... Could your DH move that classic truck to safe storage? ... Read your policy carefully and rattle ...
    (rec.crafts.textiles.quilting)
  • Re: Account policy applied to Sub-Domain
    ... > I am administering a sub-domain in a tree and am trying to change some of ... the Account Policies within the Default Domain Policy (eg. ... Maximum Password ... because Group Policy inheritance does NOT flow down domain trees. ...
    (microsoft.public.windows.server.security)
  • Re: Security Policy for OU?
    ... The DCs pull this info. from the domain; not from a specific linked GPO ... Assuming that the policy can be linked, my question is based on Ulf's assertion that: "The account policies for domain users only apply if they are in the default domain policy." ... > be recreated in the default domain policy of the child domain? ...
    (microsoft.public.windows.server.active_directory)