RE: Group Policy Inheritance

["Ramsdell, Scott" <sramsdell () stinsonmoheck com>]

Peter,

Domain password policy is domain wide and cannot be blocked.  As stated
by others, the inheritance works as you would expect except for the
default domain policy's password settings (at least).  I don't know
about other settings within the default policy, as I've always only
implemented the password and account policies in this policy.  Any other
policy I want to implement is implemented in other GPOs.

Per Microsoft: "There can be only a single password policy for each
account database. An Active Directory domain is considered a single
account database, as is the local account database on stand-alone
computers."

> From here:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technolog
ies/directory/activedirectory/stepbystep/strngpw.mspx

If you want to set a different password policy for a group of users,
administrators for instance, you will unfortunately have to have another
domain.

You would set the policy in the second domain how you want, then form a
trust, and drop the security group from the second domain into the
administrators built in security group in the first domain.  Note, the
administrators built in security group is different from the domain
admins group.

Regards,
Scott



-----Original Message-----
From: Sarbjit Singh Gill [mailto:ssgill () gilltechnologies com] 
Sent: Saturday, February 25, 2006 1:15 AM
To: security-basics () securityfocus com
Subject: RE: Group Policy Inheritance

You are right. Domain Policy still applies. 

-----Original Message-----
From: Peter Rodger [mailto:prodger2008 () yahoo com] 
Sent: Saturday, February 25, 2006 12:43 AM
To: security-basics () securityfocus com
Subject: Group Policy Inheritance

Hi all,

If we set block policy inheritance on the child OU, will the domain
policy
be blocked too (esp. domain password policy)?  My understanding is that
it
only blocks the parent OU policy, not domain policy.  Can anyone
confirm?

Thanks,

Peter

__________________________________________________

------------------------------------------------------------------------
---
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting
experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity
Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---
 
 
This communication is from a law firm and may contain confidential and/or privileged information. If it has been sent 
to you in error, please contact the sender for instructions concerning return or destruction, and do not use or 
disclose the contents to others.

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------