RE: [ActiveDir] Change Password Policy

Thu, 07 Apr 2005 08:17:08 -0700

Maybe this will help Christine. I was looking into the same issue a few days ago.

 

 

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/bb99fdd4-f8e0-490f-adae-6814cf081ff7.mspx

 

For domain accounts, the account policy must be defined in the Default Domain Policy Group Policy object (GPO) or in a new GPO that is linked to the root of the domain and given precedence over the Default Domain Policy GPO, which is enforced by the domain controllers that make up the domain. If more than one GPO containing account policy settings is linked at the domain level, the domain's account policy consists of the cumulative policy settings from all the domain-linked GPOs.

A domain controller always obtains the account policy from a GPO linked to the domain, which by default is the Default Domain Policy GPO. This behavior occurs even if a different account policy is applied to the organizational unit (OU) that contains the domain controller. By default, workstations and servers joined to a domain (such as member computers) also receive the same account policy for their local accounts. However, local account policies for member computers can be differentiated from the domain account policy by defining an account policy for the OU that contains the member computers.

 

 

Ivor Beelders

Global Directory Services

Group Information Management, Rexam Inc.

Voice: +1 704 551 1507

Voice: +44 1438 785 5710

Mobile: +1 704 458 9580

Fax: +1 704 551 1627

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Christine Allen
Sent: Thursday, April 07, 2005 10:06 AM
To: '[email protected]'
Subject: RE: [ActiveDir] Change Password Policy

 

Really?  This is what I'm afraid of and I'm having a hard time confirming.  Does anyone know for sure?  Thanks

-----Original Message-----
From: Roger Seielstad [mailto:[EMAIL PROTECTED]
Sent: Wednesday, April 06, 2005 10:57 PM
To: [email protected]
Subject: RE: [ActiveDir] Change Password Policy

I don't believe you can block inheritance on domain password policy.

 

--------
Roger Seielstad
E-mail Geek

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Francis Ouellet
Sent: Wednesday, April 06, 2005 12:09 PM
To: [email protected]
Subject: RE: [ActiveDir] Change Password Policy

Hi Christine,

 

It's going to be domain wide unless you set certain OUs to block inheritance.

 

Have a look at http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/212eb1fd-11f4-465f-b243-73e542d06b2c.mspx for more info!

 

Thanks,

Francis

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Christine Allen
Sent: 6 avril 2005 14:58
To: '[email protected]'
Subject: [ActiveDir] Change Password Policy

Hello,

 

We are looking to implement a gpo to force password changes.  Is there anyway to restrict who this applies too?  Or if I set it for the domain, it's domain wide.

 

Thanks

 

 

 

 

This communication (including any attachments) contains information which is confidential and may also be privileged.
It is for the exclusive use of the intended recipient(s).
If you are not the intended recipient(s), please do not distribute, copy or use this communication or the information.
Instead, if you have received this communication in error, please notify the sender immediately and then destroy any copies of it.

Due to the nature of the Internet, the sender is unable to ensure the integrity of this message and does not accept any liability or responsibility for any errors or omissions (whether as the result of this message having been intercepted or otherwise) in the contents of this message.

Any views expressed in this communication are those of the individual sender, except where the sender specifically states them to be the views of the company.

Reply via email to