when you have a dc, in fact you don't have LSD because it has migrated to GSD .But if you type Gpedit.msc in Run box it will open local group policy console . I've read that policies you have set in through this console neither work on dc and clients. so why we can open this console when these policies wont work ?
1 Answer
Well whatever you have read, Local Policies do work on domain controllers, as well as domain members.
The same, standard order of GPO application precedence applies here. I.e., local policies are considered the "weakest" and will be overwritten by any other Group Policies linked to OUs, Sites, or Domains where they have conflicting settings.
But if the Local Policy set on the DC contains only settings that do not conflict with any settings from other GPOs linked at higher levels, then they will apply.
In fact, I use Local Policies on many of my machines, including domain controllers, to set Windows Update automatic update times, so that the patching and rebooting of my DCs will be staggered instead of everything patching and rebooting all at 3AM.
You can verify that the local policies are indeed being applied by either running gpresult on the domain controller, or using the Group Policy Results wizard in the Group Policy Management console.
-
Wait, you allow auto updates to run on servers?! We need to discuss this, ASAP. To Server Fault Chat!– MDMarraJun 30, 2013 at 0:37
-