I've been working on adjusting our organization's computer lock settings through group policy management. I changed the lockout time from 90 minutes down to just 10 minutes. While the change isn't a big deal for some, we've had some complaints, so we're making exceptions for select users. However, after creating a new rule specifically for this group, those users are still being locked out after 10 minutes. I've enforced this new rule since the previous one applies to all authenticated users. To be honest, I've mostly been focused on server and network issues, and my colleague, who handled a lot of this, has left recently, leaving me to figure this out alone. Any advice would be much appreciated!
3 Answers
First things first, make sure both policies are applying to the machines. You can run gpresult /r - as a general user, or gpresult /r /scope:computer from an elevated terminal. Check if both old and new policies exist for the users. If you only see the new policy, it might indicate issues like failed Domain Controller replication, or that the old policy has conflicting settings that haven't properly updated. It's crucial to verify what’s actually in effect on the target machine.
Just so you know, ‘Enforced’ doesn’t work like you might expect. You should check the link order in the OU you're targeting because GPOs get applied bottom-up. A GPO with a lower numerical value in the link order wins over one with a higher number. If your GPOs are linked in the same OU, that’s likely where the problem lies.
Have you tried running gpresult /h on the affected machines? It’ll help you see which policies are actually being applied. Also, check their OU location to ensure the right policy is applied. If needed, you could deny the lockout policy for those users in the scope of the first policy.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures