3

when you have a dc, in fact you don't have LSD because it has migrated to GSD .But if you type Gpedit.msc in Run box it will open local group policy console . I've read that policies you have set in through this console neither work on dc and clients. so why we can open this console when these policies wont work ?

1
  • I've read that it's a kind of cache for dc and after a while it will remove. May 23, 2013 at 7:24

1 Answer 1

3

Well whatever you have read, Local Policies do work on domain controllers, as well as domain members.

The same, standard order of GPO application precedence applies here. I.e., local policies are considered the "weakest" and will be overwritten by any other Group Policies linked to OUs, Sites, or Domains where they have conflicting settings.

But if the Local Policy set on the DC contains only settings that do not conflict with any settings from other GPOs linked at higher levels, then they will apply.

In fact, I use Local Policies on many of my machines, including domain controllers, to set Windows Update automatic update times, so that the patching and rebooting of my DCs will be staggered instead of everything patching and rebooting all at 3AM.

You can verify that the local policies are indeed being applied by either running gpresult on the domain controller, or using the Group Policy Results wizard in the Group Policy Management console.

enter image description here

2
  • Wait, you allow auto updates to run on servers?! We need to discuss this, ASAP. To Server Fault Chat!
    – MDMarra
    Jun 30, 2013 at 0:37
  • This is just a lab environment. :)
    – Ryan Ries
    Jun 30, 2013 at 0:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .