Server 2008 R2, Default Domain Controller policy to override Default Domain Policy

Question

I am running server 2008 r2.

I have renamed the Administrator username at the Default Domain Policy, therefore this applies to the whole Domain. This policy is set in Windows Settings/Security Settings/Local Policies/Security Options/Accounts/Rename administrator account. What I want to do is set an different username for the Default Domain Controllers OU. There I want all our DCs to have a different username to the Computers and Servers which fall under the Default Domain Policy. I have created a GPO with the settings in Windows Settings/Security Settings/Local Policies/Security Options/Accounts/Rename administrator account, I have set the required username. I have linked the GPO to the Default Domain Controllers OU and disabled inheritance, so that I don’t pickup the local Domain Policy.
However its not working and the local administrator account name isn’t changing to my requirement. When I run GPresult /r it confirms my GPO has run at OU level and the Default Domain Policy hasn’t run, but it still shows the admin account with the incorrect username for the DCs that are in the Domain Controller OU. Is there are way I can run the Domain Controller OU GPO to override the Default Domain Policy, I also have the Domain Controller Policy as Enforced and in link order 1. Thanks goggles.

Answer 1

Yes you can do this by putting a BLOCK INHERITANCE on that Domain Controller's GPO. After doing that you can load all the policies that would apply to those GPOs and put your GPO with the accounts you want set on top. So it could be in this order:

1. Desired Account Setup GPO
2. Default Domain Controller GPO
3. Default Domain GPO

Above that you can apply any other GPOs you need but ensure you are still putting on all the upper level GPOs to make sure they are in the order you want.