Is the Local Security Policy on a DC same as Default domain controller policy ?

[Norman]

Hi,
Is the Local Security Policy on a DC same as the Default domain controller policy ?

Norman

 

[Kevin D. Goodknecht Sr. [MVP]]

In

Hi,
Is the Local Security Policy on a DC same as the Default
domain controller policy ?

Norman

The local security policy is the policy that is effect after the Default
domain controller policy is passed to the DC through the GPO on the Domain
Controller Organizational Unit.

 

[Herb Martin]

In

No.

They are unrelated.

The local security policy is the policy that is effect after the Default
domain controller policy is passed to the DC through the GPO on the Domain
Controller Organizational Unit.

It is a bit more complicated than this.

A DC like any other machine can have a local group policy
object (LGPO) which is a separate policy object similar to
those from the domain, but configured explicitly on a particular
machine.

Some methods of viewing these settings may show both
the "Local settings" and the "EFFECTIVE settings." The
latter is the result after the Local and Domain policies
have all been applied.

 

[Norman]

Herb,
So does it means that if I want to enforce a specific setting on that
specific DC ONLY, I can make the setting on the local security policy on it
( this is exactly what I would like to do ) ?

Norman

 

[Ryan Hanisco]

Yes this is exactly what it does.

--
Ryan Hanisco
MCSE, MCDBA
FlagShip Integration Services
Chicago, IL

 

[Herb Martin]

Herb,
So does it means that if I want to enforce a specific setting on that
specific DC ONLY, I can make the setting on the local security policy on it
( this is exactly what I would like to do ) ?

As long as no later (Site, Domain, OU) policy
overrides it.

The normal case is that the policies are applied
in this order: Local, Site, Domain, OU...ou...
with the latter having precedence.

 

[Joe Richards [MVP]]

It depends on the policy and what it actually changes. If it say changes
something that replicates through AD like a group membership or a password
policy or something like that, it will cause an issue in the system as the
policy keeps jumpng back and forth.

What specifically are you trying to do?

joe

 

[Herb Martin]

It depends on the policy and what it actually changes. If it say changes
something that replicates through AD like a group membership or a password
policy or something like that, it will cause an issue in the system as the
policy keeps jumpng back and forth.

Will a local password policy on a DC have
any effect on the Domain password policy?

What specifically are you trying to do?

Good question!

 

[Kevin D. Goodknecht Sr. [MVP]]

In

Herb,
So does it means that if I want to enforce a specific
setting on that specific DC ONLY, I can make the setting
on the local security policy on it ( this is exactly what
I would like to do ) ?

You can, so long as the default domain or domain controller security policy
is set to "not defined" on the particular policy setting. The GPO policy
will override the local policy if the setting is either enabled or disabled
in the GPO.

 

[Norman]

I need to disable the drive signing on that particular DC only so that other
team can install ( push out a System BIOS update ) with "silent run" every
3 months.

Norman

 

[Joe Richards [MVP]]

Will a local password policy on a DC have

any effect on the Domain password policy?

Yes it will cause it to loop back and forth from what that one DC has with with
all the rest of the DCs have. It is very confusing. The same thing can happen
when you make a domain policy change and it doesn't make it to all DCs.

joe

 

[Joe Richards [MVP]]

You should be able to do that with the local security policy on that DC. You can
pull up secpol.msc on that one machine.

However, I totally don't recommend giving anyone but domain admins the rights to
do any changes on DCs, anything else is a huge security hole.

joe

 

[Herb Martin]

Yes it will cause it to loop back and forth from what that one DC has with
with

all the rest of the DCs have. It is very confusing. The same thing can happen
when you make a domain policy change and it doesn't make it to all DCs.

Why wouldn't the domain GPO just override it?

(If not, it seems like a bug.)

 

[Joe Richards [MVP]]

I apologize, I spoke out of turn.

Through the GUI this is not possible. The only supportable way this can be
screwed up is when the domain policy doesn't properly replicate to all domain
controllers and the policy is out of sync on different domain controllers.

joe

 

[Herb Martin]

I apologize, I spoke out of turn.

That's ok, but when you say something it is usually
so reliable that I will tend to believe it without
checking.

Through the GUI this is not possible. The only supportable way this can be
screwed up is when the domain policy doesn't properly replicate to all domain
controllers and the policy is out of sync on different domain controllers.

That makes perfect sense.

 

[Joe Richards [MVP]]

Ah always doublecheck anything said by anyone, anyone can make a mistake. Or
possibly they just know more than they can talk about publicly and things aren't
as easily duplicated.

 

[Herb Martin]

Ah always doublecheck anything said by anyone, anyone can make a mistake. Or
possibly they just know more than they can talk about publicly and things aren't
as easily duplicated.

It is uncertain that I believe anything absolutely.
<grin>

I am a scientist at heart.

 

[Joe Richards [MVP]]

lol