I am currently preparing for some setup procedures for active directory setup. The servers are installed with default policy which includes account lockout policy. However, the setup requires user to promote the machine to become a domain controller. After the machine is promoted,

I would like to know if there is any scripting method available to modify the domain account lockout policy on an active directory.

I have done some research and found that powershell is possible for Windows Server 2008 R2. Some VBScripts are also possible to retrieve the information of the policies. But both of these cannot help me. Is it possible to script (or more

  • Edit in the Local Sytem GPO.... – Zapto Feb 6 '12 at 10:31

There are a variety of PowerShell cmdlets to manage Group Policy. There isn't, however, a cmdlet to allow you to import a security template into a GPO. As such, using PowerShell all by itself isn't going to accomplish what you're looking for. Instead, I'd recommend creating a GPO with the desired security settings (don't modify the "Default Domain Policy"-- that's bad form) and make a backup of the GPO. You can use the GPO import functionality to add it to a new destination domain in a script.

  • Yup, inspired by this answer, I create a GPO and import it with the backup GPO and link and enforce it to the domain by VBScript. Thank you! – redcomethk Feb 10 '12 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.