• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1089
  • Last Modified:

Apply domain controller GPO settings


Can somebody tell me why the local GPO settings are not overridden by the default domain controller policy? I thought the order was:


Here is the case: on a Windows 8 workstation the user can change the time zone. I would like to prevent this. In the local GPO in computer configuration / policies / windows settings / security settings / local policies / user rights assignment the following user(groups) are allowed to change the timezone: administrators, Local Service and Users.

In the domain controllers policy, I have changed it from not defined to only administrators and Local Service. Users can still change it after restarts and gpupdate /force.
Anybody any ideas?

2 Solutions
Mike KlineCommented:
The domain controllors policy affects the DCs so it is not applied to the user workstations.

You can create a policy that restricts them and link it to where the workstations are.  Definitely test it before deploying to your full domain.


SandeshdubeySenior Server EngineerCommented:
You need to create new GPO template and apply the policy to workstation computers OU or define the GPO in default domain policy template.If you configure the policy in default domain policy it will applied to all workstation in domain.

It seems that user in question is added to local admin group hence able to modify the time setting.Normal user cannot edit the time setting.

As mike mentioned policy defined in Default domain controller template will only be applied to domain controllers.
P-R-WAuthor Commented:
Thanks for that, thought that certain settings (like the User Rights assignment) from the Domain controllers would go out to the PC's as well. They are not defined in the default domain policy ....
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now