Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to apply group policy to several computers in a Windows Server 2008 domain. After running gpmc.msc, we can see Default Domain Policy and Default Domain Controller Policy

  1. Can you tell me their difference?
  2. Which policy is effective?

Source: SBS Diva (https://msmvps.com/blogs/bradley/archive/2009/05/29/group-policy-defaults-for-sbs-2008.aspx)

technet say this but I don't understand it:

Default Domain Policy is linked to the domain object and affects all users and computers in the domain (including computers that are domain controllers) through policy inheritance.

Default Domain Controllers Policy is linked to the Domain Controllers OU. This policy generally affects only domain controllers, because by default, computer accounts for domain controllers are kept in the Domain Controllers OU.

share|improve this question

migrated from superuser.com May 22 '11 at 4:50

This question came from our site for computer enthusiasts and power users.

2 Answers 2

up vote 6 down vote accepted

It sounds like you'd do well to get some background information on Group Policy before you begin making changes. Some background information on Active Directory would probably help you, too.

I'd recommend strongly against modifying the "Default..." Group Policy Objects (GPOs) that are created in Active Directory by default. You can create your own GPOs that contain your custom settings. By leaving these settings in their default state you create a situation you can disable all your custom GPOs and return everything into a default state.

To answer your specific queries (at the risk of repeating what TechNet says):

The "Default Domain Policy" is a GPO created during the creation of your Active Directory domain that contains settings that, by default, apply to all computer and user accounts in the domain. (Using the "Block Inheritance" functionality on individual OUs allows this behavior to be overridden, but that's more of an advanced topic.) The main default setting that comes out of this GPO is the domain password policy. This setting controls the parameters associated with user account lock-out and user passwords (length, complexity, expiration, re-use).

The "Default Domain Controllers Policy" is another GPO created during the creation of your Active Directory domain. It contains settings that are only applied to Domain Controller (DC) computers (that is, those computers that host copies of the Active Directory database and perform authentication functions). The main default settings that come out of this GPO in Windows 2003 and newer Windows versions are to limit the DCs to "talking to" clients that support digitally-signed Server Message Block (SMB) packets. The purpose of this setting is to increase security.

The specific details of how Group Policy is applied by users or computers is somewhat involved. In general, though, Group Policy objects are applied in the order they are encountered starting at the top of the domain and proceeding down through OUs to the computer object. The easiest way that I can relate to think about "precedence" or "conflicts" between GPOs is to imagine that all the settings are applied as each GPO is encountered, with the "effective" setting being the last setting applied to a given item.

An example: A GPO is linked at the domain sets the computer's "Offline Files" feature to "Enabled". Another GPO is linked at the OU where the computer object is located that sets the "Offline Files" feature to disabled. Because the last GPO to be applied would be the GPO linked to the OU where the computer object is located is applied last the "effective setting" for the computer would be to leave "Offline Files" in the disabled state.

The "Block Inheritance" and "No Override" functionality add complexity and powerful functionality. WMI filtering, security group filtering, and loopback policy processing add a lot of additional complexity, too, and are worth learning about. I wouldn't recommend learning about any of these features, though, until you have a good background on the general behavior of the product.

share|improve this answer
    
@seubei I can only echo what Evan has said here, especially the first two paragraphs. You need to have a better understanding of how AD and GPOs work before you can safely/usefully modify them. –  RobM May 22 '11 at 7:36
    
@Robert Moir Well, everyone is wishing for the the best brief, but reality is.... Anyway, As far as I understand, the policy is applied to the following other: 1. Default Domain Policy 2. Default Domain Controllers Policy –  Seubei May 24 '11 at 1:41
    
@Seubei: In a situation where all the default settings are still applied to the "Default Domain Policy" and "Default Domain Controllers Policy" GPOs and GPlinks, and the defaults for "Block Inheritance" are still applied to the "Domain Controllers" OU this would be true. There are a lot of things that, if tweaked from the "stock" settings, could end up making that not true. –  Evan Anderson May 24 '11 at 2:40
    
Thank you. Your answer helped me to arrive at this site which may be useful for others :) –  Seubei May 24 '11 at 8:25

Both policies are effective for the objects within the OUs they are linked to. Generally, the Default domain controller policy applies only to domain controllers.(you should see your domain controllers in that OU.

The default domain policy is linked to the top of the domain tree. To make a change for all computers use the Default Domain Policy or add a new policy.

share|improve this answer
    
I am sorry that I am new to Active Directory. If both policies are effective, what will happen if they have conflicting values? I found that DC means Domain Component. Am I correct that all computers joining the domain are called Domain Component, so both policies are effective? –  Seubei May 21 '11 at 14:27
    
@Seubei: DC means domain controller, which is a computer running Windows Server that processes logons among other things. I'm assuming you want to apply the policy to more than just servers, so you want to use the Default Domain Policy. –  Patches May 21 '11 at 19:52
2  
@Patches: "DC" means "domain component" in LDAP paths, but I agree with your suspicion that @Seubei probably means "domain controller" in the context of this question. Having said that I'd strongly recommend against modifying the default GPOs in AD. –  Evan Anderson May 22 '11 at 6:44
    
-1 It's really bad practice to modify the default GPOs. Better to suggest how to create and apply new GPOs at the same levels. –  RobM May 22 '11 at 7:37
    
@Patches: Thank you! I would like to give a +1 to you. I would also consider the best practice when I design the policy next time. –  Seubei May 24 '11 at 1:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.