Im trying to keep my Default Domain Policy clean and standard and I want to make a GPO for my password policies.

I made it but it still gets the policies from the Default Domain Policy object.

I imagine that it gets that one because it is the most restrictive one but I would enjoy one that I can make a copy of the Default Domain Policy, edit that one, and then apply first that and if something isnt applied/changed/etc, apply the default in the Default Domain Policy.

Is it possible?


Your password policy can be in a group policy you create. There is nothing special about the 'default domain policy' that is created for you.

The Policy you should be applied at the root for the best results. By being linked there directly or inherited from the root, and not be blocked. Password policies are a computer policy and are enforced by the computer with the password database. In the case of your active directory this is your Domain Controllers.

It is likely that you already have password policy settings in existing policies (they are in a default install) So it will be important to make sure the Link order of this new policy is any other policy, though you probably should remove the password settings from any other policies to prevent confusion.

If you look at the Group Policy results for one of your domain controllers you should see what policy and settings are being applied and from what Policy Object if you run into problems.

Separate password policy

Separate password policy

Policy Link order link order

Policy Results.

policy results.

  • Everything I've ever learned about domain password policies says that the password policy GPO shouldn't be linked to the Domain Controllers OU. If it is it won't be applied, as password policies in GPO's linked to OU's don't get applied. It needs to be applied at the domain level, from where the Domain Controllers will pick it up. – joeqwerty Mar 13 '15 at 0:14
  • I have it linked on the Domain Controllers OU on a domain, and it seems to be be working. It is entirely possible I may be making it work against the standard recommendations or best practices. On that particular Domain it is linked in there because their GPOs are a huge mess at the root, and so inheritance got blocked on the DC OU. Cleaning up the GPO disaster is on the to fix list, but the client has very small budget. – Zoredache Mar 13 '15 at 0:17
  • Maybe the Domain Controllers OU is exempt from the "not applied to OU's" processing rule? I've never tried it so I don't know for sure. After all, the AD security account database on the DC's for AD is the database you want the password policy to apply to. The confusion for me has been the fact that a password policy is a computer setting and affects the security account database on those computers the policy is applied to. For a Domain Controller that security account database is the AD database, therefore affecting all AD users, which is a bit of a confusing concept to get your head around. – joeqwerty Mar 13 '15 at 0:22
  • So instead of applying it at domain level and/or OU level, I have to apply it in the Default Domain Controllers Policy (by applying I mean adding a new policy besides this one, putting the link higher, and thats it?). Ive tried putting it in domain level, in a OU with only computers, etc. and it always applies the Default Domain Policy. Ive checked with gpresult /r and it is being applied but...in reality it isnt. – riahc3 Mar 13 '15 at 6:56
  • I think you've missed what Zoredache stated about the link order for your GPO. You can link it to the domain, or as Zoredache stated, to the Domain Controller's OU, but in either case it has to have the lowest link order so that it has the highest precedence so that it is applied last and will therefore be the "winning" GPO. – joeqwerty Mar 13 '15 at 15:24

Password policies set on the Default Domain Policy always apply over and above any other password policy unless you're using FGPP somewhere down the line.

it's fine to have it at the root of the domain, that's where it should be.

If you want to apply a separate password policy then you need to set all the password settings in the Default Policy to "Not Set" and then create a new GPO (or use another pre-existing one) to apply the password settings at the same, or a different level.


Create password settings defined in Active Directory Administration Center > Select your Domain > Select the System Container > Select Password Settings Container > Select "New" > Select Password Settings.

Here you can apply policies based on individual groups or users that are separate than the domain policy.

Use precedence to manage multiple policies that may apply to the same group of users.

I hope this helps.



I tried to do in the past without success. Password policies have to apply in the Default Domain Policy to work.

  • 1
    It works. You just have to do it right. Meaning you like it in the right place at a higher link order then any default policies. – Zoredache Mar 12 '15 at 23:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.