Active Directory Rights filter

Discussion in 'Active Directory' started by Denis Roy, Feb 9, 2004.

  1. Denis Roy

    Denis Roy Guest

    Is there a way to stop a GPO policy from filtering down a OU? Let say you
    have the default Domain Policy; by default password complexity filters down
    OU "X". If I don't need it to filter down, is there a way to block only the
    passwords complexity only and not effect the rest of the policy?
     
    Denis Roy, Feb 9, 2004
    #1
    1. Advertisements

  2. Denis Roy

    Chriss3 Guest

    Hello, you can set the option "Block Policy inheritance" to your child OUs
    within the Parent OU with the GPO to prevent inheritance from Higher-level
    OUs

    Right click on of your particular child OUs you want to prevent inheritance
    to. Click Properties -> Select the Group Policy tab, and check the "Block
    Policy Inheritance" below.

    Group Policy Documentation:
    http://www.microsoft.com/technet/tr...dows2000serv/reskit/distsys/part4/dsgch22.asp

    Group Policy Best Practices:
    http://www.microsoft.com/windows2000/en/server/help/sag_sp_bestprac.htm

    Group Policy Functions:
    http://msdn.microsoft.com/library/d...licy/internet_explorer_maintenance_policy.asp
    --
    Regards,

    Christoffer Andersson
    No email replies please - reply in the newsgroup
    If the information was help full, you can let me know at:
    http://www.itsystem.se/employers.asp?ID=1
     
    Chriss3, Feb 9, 2004
    #2
    1. Advertisements

  3. Denis Roy says...
    Hello Denis,

    Chris answered your questions according the inheritance of GPOs.

    However I'd like to mention that the GPO-example password complexity will not
    change. The Account Policies for Domain Useraccounts are defined in the Default
    Domain Policy and you are not able to change those within the domain. The
    account policies in other GPOs like on OUs or Sites only apply to local
    useraccounts, not to the domain users.

    If you need different account policies in your company for different domain
    users, you'll have to use different domains.

    Gruesse - Sincerely,

    Ulf B. Simon-Weidner
     
    Ulf B. Simon-Weidner [MVP], Feb 9, 2004
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.