Group Policy Implementation

[rebel4k]

I am quite new to Windows 2000 administration and I am trying to configure a group policy. When I configure the policy at Domain Level, it only seems to affect users that log onto Domain controllers and does not seem to affect any one who logs onto a workstation. This applies when the policy is set at both machine and user level. I have specified the no overide option on the Domain policy to make sure that any lower OU's are unable to block the policy but this still doesn't work. Is there anything else I need to do to make sure every machine within the Domain is able to inherit the Domain group Policy.

 

[aftertaf]

by default there are different policies installed:

Default Domain policy
&
Default Domain Controller policy

1st is linked to the domain itself
2nd to the Domain Controllers OU.

which one are you changing?

if it's the 1st one,... then the logon to workstation pb, are the users using a domain account or a local account? is the PC a member of the domain?

Aftertaf

"Solutions are not the answer." - Richard Nixon

 

[Grenage]

I wouldn't recommend changing the default policies, it's not great practice. If you check the policy permissions is it definately set to use the policy for the users you want?

Double check on a workstation by entering "GPRESULT" in a command prompt, you'll get to see what was/was not applied and why.

Russell.

 

[markdmac]

I must agree to NOT change the default domain policies. All that you should configure within them is password restrictions such as password age & complexity etc.

Create a new GPO for your settings and set the appropriate permissions for the GPO.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[alliknowisnetworking]

Like the other tekkers were expressing, it is not a good idea to touch the default group policy. b/c that applies to everyone including the enterprise admins, domain admins, etc etc. so if you make a change you cant go back.