Win2k3 Simple Policy Question

Posted on 2004-11-09
Last Modified: 2010-04-19
We are trying to define domain security policies and within the defaulted security policy MMC there are limited configuration options.  I know I am overlooking something simple, but where did all of the security/policy/user controls go?  They were concentrated within this MMC in Win2k Server but appear to have been changed.

Please point me in the right direction

Thank you
Question by:rfowleroma
    LVL 3

    Expert Comment

    Go into Active Directory Users and Computers and right click on your domain name.  This will give you the default policy for your domain.  Another option is to download the group policy management tool from Microsoft.  It lays out all of your policies in one place.  Much easier to manage that way.  Just go to Microsoft or Google and search for group policy management console.  I think what you're looking at now is the default domain controllers policy or default domain security policy.
    LVL 70

    Assisted Solution

    by:Chris Dent

    Just a warning...

    Don't alter the Default Domain Controllers Policy unless you are absolutely sure of the changes you're making. That has to be one of the easiest ways to break the domain.
    LVL 6

    Expert Comment

    The default domain policy applies to all OU's below, to control User / computer policies you should create additional GPO's at a lower level, these will give you more options than the default domain policy.

    For instance create an OU called users below the domain level, and apply the GPO to that OU.

    Accepted Solution

    In AD if you create an OU and right click. Go to Properties. Click on Group Policy. Click Add, to add a Group Policy Object Link. Here you can edit the GPO for that OU.  There you should see ample security policy settings, especially under the USERS Configuration/Administrative Templates.  Add your users to this OU and Voila!  If you need to make any changes to Computer Policy remember to reboot the system.  I agree with Chris, making changes to the Default Domain Contollers Policy is not advisable unless you need a setting that is absolutely necessary.

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    Join & Write a Comment

    Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
    A quick step-by-step overview of installing and configuring Carbonite Server Backup.
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now