Active Directory Rights filter

Is there a way to stop a GPO policy from filtering down a OU? Let say you
have the default Domain Policy; by default password complexity filters down
OU "X". If I don't need it to filter down, is there a way to block only the
passwords complexity only and not effect the rest of the policy?

 

Hello, you can set the option "Block Policy inheritance" to your child OUs
within the Parent OU with the GPO to prevent inheritance from Higher-level
OUs

Right click on of your particular child OUs you want to prevent inheritance
to. Click Properties -> Select the Group Policy tab, and check the "Block
Policy Inheritance" below.

Group Policy Documentation:
http://www.microsoft.com/technet/tr...dows2000serv/reskit/distsys/part4/dsgch22.asp

Group Policy Best Practices:
http://www.microsoft.com/windows2000/en/server/help/sag_sp_bestprac.htm

Group Policy Functions:
http://msdn.microsoft.com/library/d...licy/internet_explorer_maintenance_policy.asp
--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1

 

Denis Roy says...

Hello Denis,

Chris answered your questions according the inheritance of GPOs.

However I'd like to mention that the GPO-example password complexity will not
change. The Account Policies for Domain Useraccounts are defined in the Default
Domain Policy and you are not able to change those within the domain. The
account policies in other GPOs like on OUs or Sites only apply to local
useraccounts, not to the domain users.

If you need different account policies in your company for different domain
users, you'll have to use different domains.

Gruesse - Sincerely,

Ulf B. Simon-Weidner