Group Policy applied to Administrator on Domain Controller

[gasmask]

I've set up my server as the only Domain Controller on the network. I've been modifying the settings of the Default Domain Policy. These policies are being applied to the built-in Administrator account when I logon to the Domain Controller. Is this supposed to happen?

I would like these policy settings to NOT be applied to the built-in Administrator account. Or perhaps any user of type Administrator. Please advise!

 

[ecafracs]

You have to edit the properties of the group policy so that the GPO will not be applied to the Administrator's account. To do this right click on the domain from ADUsers and Computers,click on the Group Policy Tab,click properties , then click on security, highlight the administrator account and uncheck the "apply group policy" tick box.

 

[GrnEyedLdy]

Gasmask,

Also keep in mind that if the 'Everyone' group is in the DACL for the GPO...the policy will apply to Everyone, even Admins. If this is the case, just remove them.

Patty

 

[gasmask]

Thanks for your responses. The only objects I have under the security tab for the Default Group Policy are Authenticated User, Creator Owner, Domain Admins, Enterprise Admins, and System. Authenticated Users is the only one with "Apply Group Policy" checked.

I ran gpresult; Administrator is a member of NT Authority\Authenticated Users and \Everyone.

I'm not understanding this. I didn't make any modifications to the Administrator account or to the policies other than simple enabling and disabling settings. Shouldn't this account be exempt from the Default Group Policy as Win2K Server comes out-of-the-box? How can I make these policies not apply to the built-in Administrator?

 

[tpluskota]

Set the policy security to affect domain users only, this will stop the Admin account inheriting the policy.

Otherwise set an additional policy for your administrators giving them no restrictions.

 

[gasmask]

Ok, i have the answer. By default, the group policy is applied to the Administrator because its a member of the security group Authenticated Users.

Under the Security tab of the Default Domain Policy Properties, you can remove the Apply Group Policy by clearing the "Allow" checkbox and then add individual security groups that should receive this policy. Alternatively you can set the Apply Group Policy for Domain Admins to "Deny", which takes precendence over "Allow".