Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does anyone have an authoritative source of policies that, if set, MUST be set within the Default Domain Policy (if one chooses to set them)? Off the top of my head, I know that password policies and certain user session policies must be set within the Default Domain Policy. I'm doing a cleanup of our Domain GPOs and trying to separate any GPs that can be set outside the default...

To clarify, I am not asking what policies must be set, I am asking which policies, should I choose to set them, must be set within the Default Domain Policy.

share|improve this question
    
While there are a number of settings configured in the Default Domain Policy, I'm not aware that any of them are actually required. While you can only have 1 password policy per domain (pre W2K8) there's no requirement that I'm aware of that states that you MUST have a password policy nor that it be set in the Default Domain Policy. I'm also not aware of any user settings configured in the Default Domain Policy so I'm unsure as to what user session policies you're referring to. Can you give us specifics? –  joeqwerty Jan 2 '12 at 18:55
    
A specific example would be Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies | Security Options | Network security: Force logoff when logon hours expire. There is an information statement on that setting that states: "To affect domain accounts, this setting must be defined in default domain policy". Trying to find out how many of these are out there and which ones... –  newmanth Jan 2 '12 at 19:59
    
Another example would be password policy (for a Windows 2003 domain functional level, which we have): Each domain can have only one Account policy. The Account policy must be defined in the Default Domain Policy or in a new policy that is linked to the root of the domain and given precedence over the Default Domain Policy. See technet.microsoft.com/en-us/library/cc748850(WS.10).aspx –  newmanth Jan 2 '12 at 20:03
1  
What I'm saying is that while there are some settings configured in the Default Domain Policy by default, none of them (that I'm aware of) MUST be configured. Likewise, you can (but don't have to) have a domain password policy, which doesn't have to exist in the Default Domain Policy. "Each domain can have only one Account policy" doesn't mean you MUST have it, it means you CAN have it. Maybe a better spin on your question would be "What settings are the default settings in the Default Domain Policy?" Also, Computer Configuration settings apply to computers, not users. –  joeqwerty Jan 2 '12 at 21:32
    
No, that is not my question! I am not asking if GP settings must be configured, but if I want to configure it, does it need to be set within the Default Domain Policy? What I'm trying to find out, is if there is a list of policies, that if I CHOOSE to set them, must be set within the Default Domain Policy. Sorry if my original question was unclear. –  newmanth Jan 2 '12 at 21:44
add comment

4 Answers

up vote 5 down vote accepted

The settings you're looking for are enumerated in Group Policy application rules for domain controllers, insofar as how Domain Controller (DC) computers apply Group Policy Object (GPO) settings that are set at the domain level. You don't necessarily need to specify these settings in the "Default Domain Policy" (and, indeed, I would recommend not modifying the "Default Domain Policy"). Rather, the resultant set of these settings, based on the link order of the GPOs at the root of the domain, determines the effective setting the DCs will apply.

The settings include the following for all Active Directory DCs.

  • Account Policies
  • Security Options settings: "Automatically log off users when logon time expires", "Rename administrator account", and "Rename guest account".

Windows Server 2003-based DCs (and, presumably, Windows Server 2008 and 2008 R2-based DCs) will also apply the Security Options settings:

  • Accounts: Administrator account status
  • Accounts: Guest account status
  • Accounts: Rename administrator account
  • Accounts: Rename guest account
  • Network security: Force logoff when logon hours expire
share|improve this answer
    
Thank you, thank you, THANK YOU!!!!! That is EXACTLY what I was looking for! –  newmanth Jan 2 '12 at 22:35
    
@newmanth: Glad I could help. –  Evan Anderson Jan 2 '12 at 22:37
add comment

There are no settings that are required to be defined in the default domain policy. In fact it's best practice not to touch the default domain policy and the default domain controllers policy.

share|improve this answer
    
That is incorrect, there is at least one policy that, if set, must be defined in the default domain policy: Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies | Security Options | Network security: Force logoff when logon hours expire. There is an information statement on that setting that states: "To affect domain accounts, this setting must be defined in default domain policy". –  newmanth Jan 2 '12 at 22:03
2  
I'm staying my hand from downvoting because your answer is factually correct, insofar as it's not required for you to specify any settings in "Default Domain Policy" GPO but this isn't want the OP is asking for. –  Evan Anderson Jan 2 '12 at 22:35
    
Hmm sorry but as I re-read the question, I still say none of the settings in DDP should be changed. –  Jim B Jan 3 '12 at 6:34
    
@JimB How about password policy? Surely it can't be your recommendation to use a fine-grained password policy whenever your organization's security policy strays from the Microsoft defaults? –  Shane Madden Jan 3 '12 at 7:25
1  
@ShaneMadden There is no requirement or restriction that password policies MUST be defined and can ONLY be defined in the DDP. The account policy must be defined in the DDP or (and is best practice) in a new policy that is linked to the root of the domain and given precedence over the DDP, which is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from a GPO linked to the domain. Note that the OP asked what has to be set in DDP - the answer is and (always has been since 2000) nothing. –  Jim B Jan 3 '12 at 14:04
add comment

According to Microsoft training books the Default Domain Policy should only contain settings for password,account lockout, and kerberos policies. The Default domain controllers policy should contain your auditing policies.

share|improve this answer
add comment

Changes in settings to domain security policy should always be made to the Default Domain Policy GPO.

Changes in settings to domain controller security policy for User Rights Assignment and Audit Policy must be made to the default GPO, rather than to a newly created GPO.

Default Domain Policy: Password Policy, Account Lockout Policy, Kerberos Policy.

Default Domain Controllers Policy: Audit Policy, User Rights Assignment, Security Options, Event Log Policy.

Applies To: Windows Server 2003/2008 & R2

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.