I am building a test Active Directory forest in a virtual environment. I will be part of a team in the future that will build a new Forest for our organization. I don't have experience managing a forest or domain in a production environment, but I am familiar with GPOs and working with them as a Sys Admin. I'm using Server 2019 and the Forest and Domain Functional levels are at Windows Server 2016 (that's the highest version available). I created a new GPO to add our security settings, linked the new GPO to the Domain Controllers OU, did gpupdate /force (this indicates it completes successfully), rebooted, its been a day or so and I go to verify some settings have been applied. gpresult shows the GPO is applied, but numerous settings that are set in the GPO, are not set in the gpresult output. Here are two examples: I have "Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" set in the GPO to audit success and failure. I also have the "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" enabled. But this isn't applied to the server at all. Running "AuditPol /get /category:*" and looking at the output confirms this. The second example is "Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy". I have it set to three, but it is not applied in the gpresult output.

In both of those examples, gpresult indicates that local policy is the winning gpo.

There are other settings that are missing. There are also settings in the gpresult that have applied from the GPO. Anything I could be missing? Thanks in advance.

2 Answers 2


You should read this piece of Microsoft documentation

Certain policies only apply to domain controllers when they are linked at the root of the domain, this includes policies in the following nodes:

  • Computer Configuration/Windows Settings/Security Settings/Account Policies
  • Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options
  • Thank you. This helped but didn't fix my problem entirely. This fixed most settings that are configured within the sections mentioned in the article. The one setting not fixed is Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password length". I have it set to 15 characters in the "Default Domain Policy" and the GPO I created for domain controllers. But it still has local policy as winning. Oct 30, 2019 at 19:18
  • The article didn't address settings in "Computer Configuration/Windows Settings/Security Settings/Advanced Audit Policy Configuration". All settings in gpresult under there have the winning GPO as the Local Group Policy. Oct 30, 2019 at 19:22

Domain controllers have several built-in security settings which makes applying GPOs to them somewhat complex, especially when those GPOs are trying to manage security settings.

You should have a look at the "Default Domain Controllers Policy" which is linked to the "Domain Controllers" OU; this is likely conflicting with your GPO.

As a side note, you should avoid thinkering with domain controllers and the "Default Domain Controllers Policy" GPO, unless you really know what you are doing; if you need to test something, use different servers (or workstations), OUs and GPOs.

  • I'll be an enterprise admin in as part of building the new forest and as an end goal, so I need to understand as much of this as possible. Part of what I'm testing is applying hardening configuration to the domain controllers. I unlinked the "Default Domain Controllers Policy" already, so that isn't conflicting. It just is not applying certain settings for some reason. Oct 30, 2019 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .