RE: [ActiveDir] Change Password Policy

[Darren Mar-Elia]

The last time I checked, you could put a block inheritance on the Domain Controllers OU and this would block processing of a domain-linked GPO--even for account policy. In that case, the DCs simply use the default account policy that exists at that time. Obviously not a good thing to do. One thing I often do is, for whatever GPO is linked to the domain that enforces Account Policy, I set it to Enforced (No Override) to ensure that doesnt' happen.

 

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Christine Allen
Sent: Thursday, April 07, 2005 11:06 AM
To: 'ActiveDir@mail.activedir.org'
Subject: RE: [ActiveDir] Change Password Policy

Really?  This is what I'm afraid of and I'm having a hard time confirming.  Does anyone know for sure?  Thanks

-----Original Message-----
From: Roger Seielstad [mailto:[EMAIL PROTECTED]
Sent: Wednesday, April 06, 2005 10:57 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Change Password Policy

I don't believe you can block inheritance on domain password policy.

 

--------
Roger Seielstad
E-mail Geek

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Francis Ouellet
Sent: Wednesday, April 06, 2005 12:09 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Change Password Policy

Hi Christine,

 

It's going to be domain wide unless you set certain OUs to block inheritance.

 

Have a look at http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/212eb1fd-11f4-465f-b243-73e542d06b2c.mspx for more info!

 

Thanks,

Francis

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Christine Allen
Sent: 6 avril 2005 14:58
To: 'ActiveDir@mail.activedir.org'
Subject: [ActiveDir] Change Password Policy

Hello,

 

We are looking to implement a gpo to force password changes.  Is there anyway to restrict who this applies too?  Or if I set it for the domain, it's domain wide.

 

Thanks