RE: [ActiveDir] Change Password Policy

[Smith, Brad]

Something strange - if you download the MS Security Templates from the URL below, you get a few DC Templates and they all configure the Password Policy.  Why would they do this if this policy has to be set with GPOs linked only at the domain level? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Beelders, Ivor Sent: Thursday, April 07, 2005 4:16 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Change Password Policy Maybe this will help Christine. I was looking into the same issue a few days ago. http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/bb99fdd4-f8e0-490f-adae-6814cf081ff7.mspx For domain accounts, the account policy must be defined in the Default Domain Policy Group Policy object (GPO) or in a new GPO that is linked to the root of the domain and given precedence over the Default Domain Policy GPO, which is enforced by the domain controllers that make up the domain. If more than one GPO containing account policy settings is linked at the domain level, the domain's account policy consists of the cumulative policy settings from all the domain-linked GPOs. A domain controller always obtains the account policy from a GPO linked to the domain, which by default is the Default Domain Policy GPO. This behavior occurs even if a different account policy is applied to the organizational unit (OU) that contains the domain controller. By default, workstations and servers joined to a domain (such as member computers) also receive the same account policy for their local accounts. However, local account policies for member computers can be differentiated from the domain account policy by defining an account policy for the OU that contains the member computers. Ivor Beelders Global Directory Services Group Information Management, Rexam Inc. Voice: +1 704 551 1507 Voice: +44 1438 785 5710 Mobile: +1 704 458 9580 Fax: +1 704 551 1627 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Christine Allen Sent: Thursday, April 07, 2005 10:06 AM To: 'ActiveDir@mail.activedir.org' Subject: RE: [ActiveDir] Change Password Policy Really?  This is what I'm afraid of and I'm having a hard time confirming.  Does anyone know for sure?  Thanks -----Original Message----- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 06, 2005 10:57 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Change Password Policy I don't believe you can block inheritance on domain password policy. -------- Roger Seielstad E-mail Geek From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Francis Ouellet Sent: Wednesday, April 06, 2005 12:09 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Change Password Policy Hi Christine, It's going to be domain wide unless you set certain OUs to block inheritance. Have a look at http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/212eb1fd-11f4-465f-b243-73e542d06b2c.mspx for more info! Thanks, Francis From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Christine Allen Sent: 6 avril 2005 14:58 To: 'ActiveDir@mail.activedir.org' Subject: [ActiveDir] Change Password Policy Hello, We are looking to implement a gpo to force password changes.  Is there anyway to restrict who this applies too?  Or if I set it for the domain, it's domain wide. Thanks This message has been scanned for viruses by MailControl This communication (including any attachments) contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please do not distribute, copy or use this communication or the information. Instead, if you have received this communication in error, please notify the sender immediately and then destroy any copies of it. Due to the nature of the Internet, the sender is unable to ensure the integrity of this message and does not accept any liability or responsibility for any errors or omissions (whether as the result of this message having been intercepted or otherwise) in the contents of this message. Any views expressed in this communication are those of the individual sender, except where the sender specifically states them to be the views of the company. This email and any attached files are confidential and copyright protected. If you are not the addressee, any dissemination of this communication is strictly prohibited. Unless otherwise expressly agreed in writing, nothing stated in this communication shall be legally binding.