challBOE

<div>
Thanks, I will block inheritance.
</div>


<div>
<div class="content wysiwyg-content">
GPO - Should the Domain Controllers OU be set to block inheritance of other GPO's?<br />
My Exchange 2010 servers suddenly lost connectivity to the Domain Controllers and when checking things out, I found the Domain Controller policy some how dropped the &quot;Domain\Exchange Servers&quot; from an Audit/Manage permission. &nbsp;Tracking that down, I looked at GPOs and discovered that my Domain Controllers were inheriting all sorts of policies. <br />
<br />
So, is it best practice for the OU for the Domain Controllers to block GPO inheritance (and use only the &quot;Default Domain Controller policy&quot;? <br />
Is it best practice to set the &quot;Default Domain policy&quot; to enforced?<br />
Thanks.<br />
Environment: 2012 R2 DCs, Exchange 2010 (and legacy 2003), Functional level at 2008
</div>
</div>


GPO - Should the Domain Controllers OU be set to block inheritance of other GPO's?
My Exchange 2010 servers suddenly lost connectivity to the Domain Controllers and when checking things out, I found the Domain Controller policy some how dropped the "Domain\Exchange Servers" from an Audit/Manage permission.  Tracking that down, I looked at GPOs and discovered that my Domain Controllers were inheriting all sorts of policies. 

So, is it best practice for the OU for the Domain Controllers to block GPO inheritance (and use only the "Default Domain Controller policy"? 
Is it best practice to set the "Default Domain policy" to enforced?
Thanks.
Environment: 2012 R2 DCs, Exchange 2010 (and legacy 2003), Functional level at 2008

Best practice GPO for Domain Controllers OU

Exchange is the server side of a collaborative application product that is part of the Microsoft Server infrastructure. Exchange's major features include email, calendaring, contacts and tasks, support for mobile and web-based access to information, and support for data storage.

Exchange

A domain controller is a server that responds to security authentication requests within a computer network domain. It is a network server that is responsible for allowing host access to domain resources. It authenticates users, stores user account information and enforces security policy for a domain

Domain Controller

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.