AD Password Policy ??

[bran2235]

Hello everyone,

I need to put a PW policy in very soon. Can someone tell me if the below is the correct way:

1.) We have a single domain/site so I went to ROOT level and added new policy ("Domain PW Policy"), and checked the box for "No Override" (??- saw this on MS site, why do I do this??)
2. I moved the new policy to the top of the list
3.) I did not touch the Default Domain Policy
4.) When the time comes to put this in place I will adjust the GPO accordingly...

One More Question:
Since I checked "No Override" for the New PW Policy (GPO), is this going to mess up my Domain (default) Kerberos settings? I noticed that the Kerberos setting had whole bunch of settings in the Default Domain GPO.. Should I match/copy these here to the new PW Policy GPO? I think the new PW POLICY is going to override the Default Domain Policy and thus override the kerberos settings there...

Help!

Thanks!
Brandon

 

[pbxman]

Your default domain policy is the one that should be configured with the password lockdown. The "No Override" means that no other policy configured can "override" this one. Its up to you how complex you want to make things, but you want to leave that unchecked and it wont matter where it's placed in the list. It makes it much easier to troubleshoot as well. You want every workstation and server in the domain to follow these requirements, so it will affect anything that uses it. Thats how it should be..all or nothing.

pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[bran2235]

Are you saying scrap the new GPO all together? Everywhere I read says to create a new GPO(?)

So, in short, make my password policies at the Default Domain Policy???


Thanks,
Brandon

 

[Atomic]

The reason why you would want to make your own pw policy is quite simple. Using no override is correct. The same policy (it is a computer configuration policy - so remember to diable the user configuration) must be set on all computers - including DC's).

However the Default domain policy can have others settings - for example - locking down a desktop or setting offline folders or whatever - which you may not want to force onto servers or DC's.

Your approach is absolutely correct.

GL

Martyn

 

[BenChristian]

Should I match/copy these here to the new PW Policy GPO? I think the new PW POLICY is going to override the Default Domain Policy and thus override the kerberos settings there...
"

No you don't need to. The new policy will only override settings that are defined in the new policy. Considering that you are only defining password settings in the new policy, the kerberos settings defined in the default policy will remain in place. Any settings that are "not configured" will not override settings in other policies.



Ben Christian
MCSE, MCSA:Messaging

http://www.benchristian.com

 

[bran2235]

Atomic-

..."The same policy (it is a computer configuration policy - so remember to diable the user configuration) must be set on all computers - including DC's)."

Can you explain (sorry) what you mean here?


Thanks!
Brandon