All the time I thought the Default Domain Policy overwrites other policies as it is the most important. I also known that having 2 Password GPO is not correct. The way to have different policies is to use faine-grained password policy.

Today at my company I noticed that in our domain I have Password policy in Default Domain Policy with specified length and maximum password age 90 days). To the other OU, which contains only FTP servers, I have another policy with different password complexity and maximum password age 0 days).

I checked which policy wins using gpresult and FTP server shows that Default Domain Policy does not wins.

I cannot test it. Which polisy is really applied to those FTP servers? I was reading all the time, that it must be just one policy for whole domain. Maybe it was just good practice, but such policy normally works? I am really confused.

BTW. Default Domain Policy has also different User Rights Assigment and it is also not forced to other servers, where the habe another policies with User Rights Assigment used.

Thanks, Sus


Password policy settings apply to the computer's local security database (Security Account Manager). On Domain Controllers that database is the Active Directory database. On member computers that is the local security database of the member computers. Therefore the password policy settings defined in the Default Domain Policy GPO will by default apply to Active Directory user accounts and to local user accounts on member computers.

When you apply a GPO with different password policy settings to computer accounts in the domain as you have with your password GPO linked to your ftp servers OU, you are applying those password policy settings to the local security database of the ftp servers, meaning these password settings will apply to users in the local security database of those servers and will affect the local user accounts on the ftp servers.

You see your GPO as the winning GPO because it is in fact being applied to those servers, but again, it applies to the local security database of those servers and affects only local user accounts on those servers. It does not affect domain user accounts.

When you read "There can only be one password policy in the domain", what you should read is "There can only be one password policy in the domain for domain user accounts". You can apply different password policy settings to member computers, but those settings will only affect the local user accounts on those computers.

Note that this answer doesn't address FGPP. In your scenario, this answer addresses your question and your concern.


FGPP has precedence over Default Domain Policy.


Thanks. That answers on my question. We do not have FGPP. This question was about those specific password setting in both policies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.