|
Posted by Roger Abell [MVP] on November 30, 2006, 10:54 pm
Please log in for more thread options If you have multiple GPOs linked to the domain object, make sure
that the Account Policies are set in the highest priority of the GPOs,
or at least so that they are not overwritten by a higher priority GPO
linked to the domain. This does not have to be done in the default
domain GPO.
> Hello-
>
> I'm trying to stop the practice of having Domain user account passwords
> expire in a domain (not my idea).
>
> I thought by creating a new GPO & linking it to the root of the domain -
> that would work. Doesn't seem so (gpresult shows the GPO applying to the
> Computer Settings, but on the user Settings, I get Filtering: Not Applied
> (Empty)) I'm assuming this because the settings are in the Computer
> Config section & not User...
>
> A lot of posts mention linking the 'Default Domain Policy' GPO to the
> domain to do this, but the Max Password Age is in the Computer Setting
> section, so I thought I'd get similar results if I linked it...
>
> So when I run gpedit.msc on a DC, I see what appears to be the culprit:
> the Security Settings-Account Settings-Password Policy-Max Password Age;
> however, it only appears to be able to accept a numeric value, not a
> enable/disable option... Is this where I should make the change or do I
> need to go back to the 'Default Domain Policy' in order to accomplish what
> I need to?
>
> TIA,
> Brian
| 
XML Sitemap