Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How does precedence work for the Default Domain Controller Security Settings vs the Default Domain Security Settings in a Windows 2003 domain.

  • Does one override the other? What are the conditions for this? One is defined and the other isn't, if they are both defined, etc...
  • If there is a conflicting policy settings for different controllers, does it just depend on which a person authenticates with? For example, if DC A has a Max Password Length of 2 days, and DC B has a max of 5 days. After 4 days will there password not expire unless they authenticate against DC A ?
share|improve this question
up vote 1 down vote accepted

In 2003 domains password settings are defined domain-wide via the Default Domain policy, and can not be defined on a granular level. If you want granular password settings (by OU for example) you need to move up to 2008 AD.

The order of precedence for GPO is as follows (first is least):

  1. Local Policy
  2. Site Policy
  3. Domain Policy
  4. OU Policy

If you define something in the Local policy, and there are no policies in the Site, Domain, or OU that contradict that setting, the Local Policy setting will stick. Otherwise, Site will take precedence, then Domain, and highest on the tree is OU policies.

share|improve this answer
Thanks for clearing my head with your comment to my answer, which I've deleted to defer to you and Sam :) – squillman Nov 9 '09 at 16:17
It was a slightly vague question, so no bother! :) – Izzy Nov 9 '09 at 16:19
Was as un-vauge as I could be with my limited vocabulary / understanding on the topic :-/ – Kyle Brandt Nov 9 '09 at 16:21
It obviously wasn't very vague which is why I got it Kyle :) I did say slightly vague! – Izzy Nov 9 '09 at 16:37
It's worth noting that domain password policy is controlled by the resultant set of policy of all GPOs at the root of the domain, and not just the contents of the "Default Domain Policy". I don't ever modify the "Default Domain Policy" or "Default Domain Controllers Policy" in the field. I always create additional GPOs to override these settings, such that I can always disable my GPOs and return Active Directory back to "stock" behaviour if I need to. – Evan Anderson Nov 9 '09 at 17:03

GPO is applied in the following order:

  1. Local Group Policy
  2. Site based Group Policy
  3. Domain based Group Policy
  4. OU based Group Policy

Where there are multiple policies at each level, the one with the lowest link order preference is processed last.

The Default Domain Controller Security Setting comes in at the local level, so is applied first. Any settings at site, domain or OU level will override these settings.

Password policy settings are only supported at a domain level (at least in server 2003 and 2000), not OU or site level. Were you to set this at the local level, it would only apply to local accounts, which do not exist on a DC.

share|improve this answer
Both yours and Izzy's seemed equal helpful to me and answered my question, so I accepted Izzy's solely on the fact that is 'answered time' stamp said he posted his earlier. So thank you to you as well :-) – Kyle Brandt Nov 9 '09 at 16:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.