Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently preparing for some setup procedures for active directory setup. The servers are installed with default policy which includes account lockout policy. However, the setup requires user to promote the machine to become a domain controller. After the machine is promoted,

I would like to know if there is any scripting method available to modify the domain account lockout policy on an active directory.

I have done some research and found that powershell is possible for Windows Server 2008 R2. Some VBScripts are also possible to retrieve the information of the policies. But both of these cannot help me. Is it possible to script (or more

share|improve this question
Edit in the Local Sytem GPO.... – t1nt1n Feb 6 '12 at 10:31
up vote 3 down vote accepted

There are a variety of PowerShell cmdlets to manage Group Policy. There isn't, however, a cmdlet to allow you to import a security template into a GPO. As such, using PowerShell all by itself isn't going to accomplish what you're looking for. Instead, I'd recommend creating a GPO with the desired security settings (don't modify the "Default Domain Policy"-- that's bad form) and make a backup of the GPO. You can use the GPO import functionality to add it to a new destination domain in a script.

share|improve this answer
Yup, inspired by this answer, I create a GPO and import it with the backup GPO and link and enforce it to the domain by VBScript. Thank you! – redcomethk Feb 10 '12 at 17:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.