Default Domain Controllers Policy applies to Domain Controlelers OU. Default Domain Policy applies to the entire domain, including Domain Controllers OU. Basically this means you can define account policies in any of the GPOs, and it will affect entire domain - since they both affect domain controllers (the thing which matters with account policies for domain accounts).
I'd define account (including password) policies in Default Domain Controllers Policy GPO if I need to have one settings for domain accounts and different settings for local accounts on domain computers. If you need the same settings for domain accounts and local accounts on the computers throughout the domain, it would be easier to define account settings in Default Domain Policy.
No matter what, you may have only one password policy set per domain.
--
Dmitry Korolyov [
[email protected]]
MVP: Windows Server - Active Directory
On Windows server 2000, could someone explain difference
between the "Domain Security Policy" and the "Domain
Controler Security Policy".
I would like to set password length and number of days
till password expires for all users in our domain.
Thanks
