GPO not overridding Default Domain policy
Posted on 2013-11-07
2008 domain structure. I have a Default Domain policy defining [computer configuration>Policies>windows settings>security settings>password policy>Max password age = 45]
I have OU created called restricted. I want to have the USERS in that OU have a policy of 30 days. But I want the rest of the settings in the default domain policy to still apply to these users.
I have created the GPO, applied it to the OU, the group policy inheritance tab in Group Policy Management.msc shows the two policies, both are set to Enforce, both are set to Enabled. Precedence 1 is the default domain policy and 2 is the GPO created for that OU. I force AD replciation, do a gpoupdate /force on the users workstation, but rsop.msc still shows the 45 days.
If the order of precedence is Local / Site / Domain / OU what would be preventing that GPO from changing it to 30?