[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 585
  • Last Modified:

Domain Controller Security Policy Vs. Domain Security Policy

Hello Experts,

We have enabled password complexity in our Domain Controller Security Policy however the same is disabled in Domain Security Policy.

Now, when we change the default domain administrator password, the non-complex password is getting accepted.  Is this right behaviour.  We would actually want complexity applied to domain admin account but not the normal users.

Where are we going wrong ???

Thanks.
0
ociadmin
Asked:
ociadmin
  • 4
  • 2
  • 2
1 Solution
 
AwinishCommented:
Is it windows 2003, if yes, the password policy has to be set & applied at domain level & it has to be modified using default domain policy. There is single password policy supported for windows 2003.

http://technet.microsoft.com/en-us/library/cc875814.aspx
0
 
ociadminAuthor Commented:
Thanks Awinish

Yes, it is windows 2003.  If password policy is applied by Domain Security Policy, then what exactly is the use it same policy settings in Domain Controller Security Policy ???  

What for are we suppose to use account/password policies in DCSP ???
0
 
AwinishCommented:
DCSP is applied only to DC's where as Default domain policy is applied to all the system in the domain.
0
Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

 
ociadminAuthor Commented:
Awinish,

My question is only with regard to Account/Password policies.  If accounts are controlled by account/password policies specified in DSP, then why do we have account/password controls in DCSP, what is the essence of them being there ?
0
 
AwinishCommented:
This is design, you will see same settings/options in all the GPO's, not only in default or default domain controller policy.
You can even configure password policy in DCSP & link to the domain. So, the option is present because of design.

0
 
Premkumar YogeswaranCommented:
Hi,

Default domain policy will be applied to all the computer in the domain.

Domain Controller policy will be applied for the computers only in the domain controller OU...!

If you specify any password policy in Domain controller policy, it will over write the default domain policy.
If DC policy is not configured, default domain policy will be applied to the domain controller OU.

Hope this will clears your question...!

Regards,
Prem
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 4
  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now