Hi all,
We are having a debate about whether or not you can have more than one password policy on a single domain. The question really is, can you have more than one password policy on the domain, and can they be applied individually at the OU level? Or, is my only option to configure the root domain GPO with this information and have it propogated to all the lower OUs? Here is one link I found, but I don't think it is clear enough.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/DepKit/9cc167c8-cf2d-420d-96a1-e00d5aac13f5.mspx"Avoid editing the Default Domain GPO and the Default Domain Controllers GPO
The Default Domain GPO and Default Domain Controllers GPO are vital to the health of any domain. The Default Domain GPO provides the basic domain encryption key, and if that policy is removed or deleted, users cannot unencrypt their files. There are two exceptions:
Editing the Default Domain GPO to define account policies, including password policies, account lockout policies, and Kerberos policies.
Editing the Default Domain Controllers GPO to define user rights assignment and audit policy for the domain controllers OU.
Top of page
Set domain account policy in the Default Domain GPO
When you set account policies (including password policies, account lockout policies, and Kerberos policies) in Active Directory, there can only be one domain account policy throughout all servers, workstations, and domain controllers in the domain. The policy is the account policy that is applied at the root domain of a domain tree. Although account policies affect user accounts, the policies are defined on computers."
This article says don't edit the default domain GPO EXCEPT - to define account policies, including password policies, account lockout policies, and Kerberos policies.
Does that mean I can't leave the root domain GPO undefined and then define a password policy for each OU?
Unfortunately this is getting political and the only way I can accept an answer is with a link from a vendor source such as tech net. I've found the one link above, but need something more concise/thorough.
Thanks in advance!
