Click here to get back home

Default Domain Controllers Policy scope

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Default Domain Controllers Policy scope David Anderson 05-15-2006
Posted by David Anderson on May 15, 2006, 11:26 am
Please log in for more thread options
: quoted-printable

We recently installed a Windows 2003 SBS server and I was wondering if =
by default the Default Domain Controllers Policy should be changing =
settings for the client computers or just the DC. It appears to be =
applying its settings to the client computers. Is this the default =
behavior?

Thanks,
David
------=_NextPart_000_00CB_01C67801.AC9AE2D0
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.2873" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>We recently installed a Windows 2003 =
SBS server and=20
I was wondering if by default the Default Domain Controllers Policy =
should be=20
changing settings for the client computers or just the DC.&nbsp; It =
appears to=20
be applying its settings to the client computers.&nbsp; Is this the =
default=20
behavior?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Thanks,</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>David</FONT></DIV></BODY></HTML>

------=
Posted by Roger Abell [MVP] on May 15, 2006, 11:40 am
Please log in for more thread options
In normal Windows AD the Default DC GPO is linked to the DC OU,
and in the DC OU there are only DCs. I would expect this is how SBS
also sets up this part of AD control. If so, the policy settings in the
Default DC OU would apply only to DCs.
What specific policies are you seeing applied to workstations from
this GPO, and, are you sure those are not set also elsewhere, in a
different GPO (perhaps linked to the domain object).
You may find using the RSoP capability with GPMC (download the
Group Policy Management Console) can help you diagnose this.


We recently installed a Windows 2003 SBS server and I was wondering if by
default the Default Domain Controllers Policy should be changing settings
for the client computers or just the DC. It appears to be applying its
settings to the client computers. Is this the default behavior?

Thanks,
David



Posted by David Anderson on May 15, 2006, 12:23 pm
Please log in for more thread options
I wasn't sure if I had accidentally changed the setting or not. Right now,
the Default DC GPO is linked to the DC OU and the local forest. There are
settings in the Default DC GPO that are being applied to clients that I do
not want so if I remove the forest from the links that would unlink the
Default DC GPO from the clients right?

What is RSoP? Kind of new at this stuff.

> In normal Windows AD the Default DC GPO is linked to the DC OU,
> and in the DC OU there are only DCs. I would expect this is how SBS
> also sets up this part of AD control. If so, the policy settings in the
> Default DC OU would apply only to DCs.
> What specific policies are you seeing applied to workstations from
> this GPO, and, are you sure those are not set also elsewhere, in a
> different GPO (perhaps linked to the domain object).
> You may find using the RSoP capability with GPMC (download the
> Group Policy Management Console) can help you diagnose this.
>
>
> We recently installed a Windows 2003 SBS server and I was wondering if by
> default the Default Domain Controllers Policy should be changing settings
> for the client computers or just the DC. It appears to be applying its
> settings to the client computers. Is this the default behavior?
>
> Thanks,
> David
>



Posted by Florian Frommherz on May 16, 2006, 4:11 am
Please log in for more thread options
Howdy David!

David Anderson wrote:
> I wasn't sure if I had accidentally changed the setting or not. Right now,
> the Default DC GPO is linked to the DC OU and the local forest. There are
> settings in the Default DC GPO that are being applied to clients that I do
> not want so if I remove the forest from the links that would unlink the
> Default DC GPO from the clients right?

Yes - just unlink the GP from the local forest. The objects in Domain
Controllers OU will afterwards still apply the settings and your clients
won't. I don't know your OU structure in detail - but it reads a little
confusing to me. Don't you organise your clients and users in OUs and
SubOUs?

> What is RSoP? Kind of new at this stuff.

RSoP means Resultant Set of Policies and can be called by executing
Start->Run->"rsop.msc" on a client. It shows you what policies and
settings a client applies (computer and user side). RSoP can help you
troubleshoot GP issues.

cheers,

Florian
--
Nachwuschsadmin aus dem Süddeutschen/Germany.
eMail: Vorname [bei] frickelsoft [Punkt] net.

Similar ThreadsPosted
Default domain controllers policy not applied to my server (2k3 sbs) January 3, 2006, 8:32 am
secpol on DC vs. Default Domain Policy? November 30, 2006, 6:12 pm
ENTERPRISE DOMAIN CONTROLLERS Vs Domain Group Domain Controllers December 30, 2005, 3:08 am
Reset Group Policy back to out of the box default August 28, 2006, 11:19 am
Locking Down Domain Controllers January 26, 2007, 4:46 am
"Read-Only" branch office domain controllers? April 20, 2006, 2:34 am
Access Based Enumeration on Domain Controllers ? February 26, 2007, 6:15 pm
Microsoft PKI: problem with autoenrollment for domain controllers August 14, 2007, 8:51 am
Certs for Domain Controllers-Trying to Prevent an Issue March 19, 2008, 12:28 pm
Windows 2003, Domain Controllers & "Manage auditing and security November 1, 2006, 4:43 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap