Default Domain Policy -- Password Changes

[Lori]

We changed Password settings in the Default Domain Policy
by using Terminal Services to the domain controller, then
choosing Default Domain Policy from Administrative Tools.
The policy did not take effect, and that was yesterday
afternoon around 5:00. We found article 269236, which
should take care of the problem because Block Policy
Inheritance is checked on the Domain Controllers
container, but I read documentation that the password
policies set in the Default Domain Policy would always
take affect, even if inheritance is blocked. What I'm
thinking is the Default Domain Policy is linked to the
domain in Active Directory Users and Computers, therefore
the block inheritance is taking effect. If that were
removed from that level -- I thought the Default Domain
Policy would be dynamic enough to not have to be linked
(we only have one domain) -- then the block inheritance
would not block the password settings on the Default
Domain Policy. Any thoughts?

 

[Don Ferguson[MSFT]]

Hi Lori,
First thing, you are correct to change password settings at the Default
Domain Policy.
You are correct that the "Block Policy Inheritance" on the Domain Controller
OU would prevent it from getting there as indicated in the article you
pointed out.

The Default Domain Policy must be linked to the Domain. A Group policy
object that is not linked to a domain, site or container will not have any
effect on any objects in the AD.

So, if you uncheck the Block Policy Inheritance at the Domain Controllers
container, then the policy can apply from the domain level.

If you do this and are still not getting the policy, then there is something
else blocking it from applying.
A good tool to use to troubleshoot this would be gpresult.exe

http://support.microsoft.com/default.aspx?scid=kb;en-us;321709&Product=win2000

This article may be helpful as well.

http://support.microsoft.com/default.aspx?scid=kb;en-us;221930&Product=win2000

Thanks
Don Ferguson
Microsoft Directory Services Team