Re: Group Policies

From: Steven L Umbach (n9rou_at_no-spam.ameritech.net)
Date: 04/30/04 

Date: Fri, 30 Apr 2004 06:17:50 -0500

Domain Controller Security Policy is just for objects [domain controllers]
in the domain controller container which is essentially an OU though not
called one. Domain Security Policy is the default policy that will apply to
all machines in the domain other than those that have an overriding defined
setting at the OU level. Keep in mind that policy is applied in this order
local>site>domain>OU.

Any setting defined in the domain controller cotainer will override domain
settings which is why you are the setting you define at the domain level
will not allow the user to logon to a dc since Domain Controller Security
Policy has user rights defined.

There are a couple of notable exceptions in that domain password/account
policy for domain users can only be defined at the domain level and the user
right for add workstations to the domain will only be effective at the
domain controller container level. -- Steve

"Skip" <efl713@hotmail.com> wrote in message
news:639701c42e5f$47ec5d20$a601280a@phx.gbl...
> Can someone please tell me the difference between "Domain
> Controller Security Policies" and "Domain Security
> Policies". Also, why do I have to give a user
> permissions to log on locally with both the "Local
> Security Policy" and the "Domain Security Policy" before
> a user can logon to the domain controller? Doesn't the
> domain policy override the local policy?

Relevant Pages

  • Re: Domain
    ... Domain Controller Security Policy has all user rights assignments ... Configuring ipsec policy at the domain level ...
    (microsoft.public.win2000.group_policy)
  • Re: SBS 2003 Lost all the Security Policies.
    ... i didn't use dcgpofix i used another sbs 2003 premium has example and created the policies manually. ... I know that your Default Domain Controller Security Policy or Domain Security Policy it is empty. ... DCGPOFIX.EXE will restore the Default Domain Policy and the Default Domain Controller Policy to original default settings. ...
    (microsoft.public.windows.server.sbs)
  • Re: Domain Security Policy vs Domain Controller Security Policy
    ... Does Domain Controller Security ... > Policy just effect the DCs and Domain Security Policy effect the whole ... > domain which includes the DCs? ...
    (microsoft.public.win2000.security)
  • Re: Domain Security Policy Versus Domain Controller Security Policy
    ... > Domain Security Policy Versus Domain Controller Security Policy. ... means it takes longer to process the settings. ...
    (microsoft.public.win2000.active_directory)
  • Re: Security hierarchy
    ... policy level also. ... >>can be configured only at domain level. ... Try running security configuration and ... >>try not to change domain and domain controller policy, ...
    (microsoft.public.win2000.security)