Confuse about Block policy inheritance

[Johnny Chow]

Hi,
I am a newbie. I am confused about concept of block inheritance. I
will be appreciated for you information.

Domain policy (no override disable)
Computer -> .... -> Minimum password character (5)
User->.........desktop-> Hide all icon on desktop (enable)

OU Policy (jchow user)
Block inheritance (Enable)

Lock onto jchow user
I am able to see all icons on desktop (block policy inheritance, works!!)
Yessssss
I am not able to change password that less than 5 characters (*******block
does not work**********) Whyyyy?

Please help me to clear the confusion.

By the way, it is a way to reset the group policy to default value. That's
say, I modify a lot of parameters just for test. Is there a way to reset
it instead of delete and create new group policy.

Thak you,

 

[Tim Hines [MSFT]]

There is only one password policy per domain and it applies to all users.
If you specify a password policy at the OU level it will apply to the local
password policy of the computers that are in the OU. It will not affect the
domain users password policy.

Take a look at the following articles

221930 Domain Security Policy in Windows 2000
http://support.microsoft.com/?id=221930
269236 Changes Are Not Applied When You Change the Password Policy
http://support.microsoft.com/?id=269236

There are utilities to reset the default DC policy and Default domain.
Recreatedefpol.exe can be used for 2000 domains and dcgpofix.exe for Windows
2003.


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.