newbie, multiple password policies?

[wiimike]

I have a domain which has a domain level policy for lockout stuff (lockout length, wrong attempt limit).

The problem is that I am at a school with many kids who constantly lock themselves out. I made a GPO in a lower OU to overwrite the domain GPO, which to my understanding gets applied after the domain wide GPO. So theoretically the way I understand it I should be getting my desired result, but I do not. This GPO gets applied at least in parts, as some settings (forcing a background picture) do take effect. From the tools I have used to figure out if it gets applied or not it does not seem to (on the domain controller GPO snap in, resultant policy modeling wizard or some such, it shows that my low GPO gets applied for say background settings, but it isn't even on the list for lockout policy.

I could use all the help I can get as this is driving me nuts.

 

[Davetoo]

You can only have one password policy on a domain.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[porkchopexpress]

You can purchace third party software to allow you to have multiple password policies.

http://www.specopssoft.com/products/specopspasswordpolicy/

It's also a new feature in Windows 2008 server.

 

[wiimike]

bummer, but thank you very much for the responses.