I am applying a Domain level group policy to all my machines including in Domain Controllers. The PDC is getting the policy correctly but the other domain controller is not showing the "Account Policies" correctly. It is showing them as "Not Configured". This includes the Account and Password Policy. The strange thing is when you do something that complies to that policy, such as logging in on an account incorrectly 3 times, it locks you out. That is the correct for the policy.

When I run rsop.msc it shows all of the other settings in the policy correctly just not the Account Policies. Any ideas of what I can do to make them show up correctly? When I rand a GPRESULT it show everything applied but the Account Polices.

  • Has the GPO replicated to Sysvol all domain controllers, and are the GPO files intact and the same (including gpt.ini)?
    – Greg Askew
    Dec 15, 2015 at 20:10

1 Answer 1


That's intended behavior - those policies are only set in one place for the entire domain, they're not customizable to say, have one domain controller have a more strict lockout policy.

Since it's only set in one place, the PDC is the one DC to show the settings as applied, but they're still applied to all DCs in the domain. See this KB article for reference.

  • All the machines on the domain show the policy set on the them correctly. So your saying since the PDC is the one that sets the policy though it does not show in GPRESULT the policy is still applied to all other DC?
    – JukEboX
    Dec 15, 2015 at 20:10
  • Correct, it's not shown on all the DCs and that's ok. Dec 15, 2015 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .