I'm currently facing an issue with a new Group Policy Object (GPO) that I created to change the maximum password age. This GPO is linked directly below the Default Domain Policy (DDP), which has the link order of 1, while my new GPO is at link order 2. I made this separate GPO intentionally because I know the recommendation to keep the Default Domain Policy untouched. However, even though my new GPO should apply with the normal rules of 'last applied wins', it seems that the settings from the Default Domain Policy always override mine. Why is the precedence behaving this way? Is there something specific about password policies or account policies that I'm missing?
5 Answers
Have you checked if it's applied correctly? Try running 'gpresult /h c:report.html' to see if the policy is applied or denied. It can give you insight into whether your settings are actually taking effect.
You're dealing with a specific scenario in Group Policy. For account policies (like password, lockout, etc.), they are only processed from the highest precedence GPO linked to the domain root. This means that even though your GPO applies later in the link order, domain account policies are evaluated differently, and the DDP ultimately takes precedence. If you want distinct password policies, consider using Fine-Grained Password Policies as that's the modern approach.
Remember, when you set a domain password policy, it affects the domain controllers. That's why users must meet those requirements since it's the domain that enforces the policies, not just the local machines. Setting policies on the Domain Controllers OU can change how they function, often in surprising ways!
Keep in mind, the password policy applies to the domain level rather than local accounts. The configurations affecting domain users are enforced by the domain controller, not the local machines.
The guideline to leave the Default Domain Policy untouched doesn't quite apply here. This best practice often leans more toward avoiding random changes to the DDP that would impact all users everywhere. Password policies are usually set at the domain controller level, so they need to be configured in the Default Domain Controllers Policy for proper application to users.
Exactly! The account policies usually override other settings, so Fine-Grained Password Policies is really the way to go for anything unique.