Local and Domain Security Policies

[quikslvr311]

Well we have recently implemented AD. I have noticed that all win2k member servers are automatically using the domain security policy by default. Where before we implemented AD, they would use the local security policy on the server. Does anyone know how I can use a local security policy on a win2k member server and not have it select the domain security policy? All of the local security policies are grayed out on the member server and no modifications can be made. Can I modify this for a particular server on a win2k DC?

Thanks

 

[brontosaurus]

If you log in as local or domain admin, you should be able to modify the local security policy. However, any conflicting policies coming from the domain will take precedence over the local...

 

[quikslvr311]

The particular server that I want to use a local policy is a win2k server and it is logged on locally. However the domain policy is overiding the local policy. Do you know of a way to bypass this or would I have to make a change to my domain policy??

 

[brontosaurus]

as long as we're not talking about account policies, you could create an OU, put the server in it, and check off "Block Policy Inheritance" on the Group Policy tab....

 

[quikslvr311]

Darn. On this particular member server their are separate user accounts for an appliation. These are separate user accounts from the normal network user accounts....