|
server
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
Group Policy QuestionToday I have a default group policy for all of my users. I created a
different O.U. for each department. Now I would like a different group policy per O.U. Do you have instructions for doing this? Example I will set a different password policy per OU. Thanks, Scott Stosti,
Bad choice for an example. You can have only one password policy per domain. You can not have a different password policy linked to each OU. This will not have the desired effect. Now, why did I write my response this way? Because you very much can have a password GPO and link it to each OU. However, it will not affect any domain user account objects that might be located in that OU. These user account objects are under the Scope of Management of the password policy set at the Domain level. What will fall under the Scope of Management of the OU-linked password policies would be any local user accounts of any computers that might also be located in these OUs. And, we are probably not interested in something like this. Users generally do not have local user accounts (meaning, local in the computer....they have the domain user account objects). If you want to have different OUs and place the desired user account objects in the appropriate OU in your new OU structure you can simply create and link the desired GPO to the correct OU. How do you create a GPO and link it to an OU? There are basically two tools for this: the ADUC and the GPMC. If you are using the ADUC MMC (Active Directory Users and Computers) then you simply right click the OU in question, select properties and then go to the Group Policy tab. There you would click on new, give it a name (or, a Friendly Name in gpoesse) and you have just created the GPO and linked it to that OU. Huh? But there is nothing there. Correct, but you have created and linked. Now you need to edit! So, click on the edit button and do your thing. Once you have done this for this OU you would repeat the process for each OU. I might suggest that you check out the GPMC. It is a really neat tool. There are lots of articles on this. Please note that once you install the GPMC you will not be able to use ADUC for purposes of creating/editing GPOs. The GPMC takes that role over for good once installed. Now, please understand that when you create and link the GPO that you have performed two separate functions. You have created the GPO and then linked it to the desired OU. That GPO exists in Active Directory. You can use that same GPO and link it to several OUs. Does this help you? -- Show quoteHide quoteCary W. Shultz Roanoke, VA 24012 "stosti" <sto***@discussions.microsoft.com> wrote in message news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... > Today I have a default group policy for all of my users. I created a > different O.U. for each department. Now I would like a different group > policy per O.U. Do you have instructions for doing this? > > Example I will set a different password policy per OU. > > Thanks, > Scott THANK YOU for taking the time to explain this to me. I will just live with
what I have for now... Thanks, Scott Show quoteHide quote "Cary Shultz" wrote: > Stosti, > > Bad choice for an example. You can have only one password policy per > domain. You can not have a different password policy linked to each OU. > This will not have the desired effect. > > Now, why did I write my response this way? Because you very much can have > a password GPO and link it to each OU. However, it will not affect any > domain user account objects that might be located in that OU. These user > account objects are under the Scope of Management of the password policy set > at the Domain level. What will fall under the Scope of Management of the > OU-linked password policies would be any local user accounts of any > computers that might also be located in these OUs. And, we are probably not > interested in something like this. Users generally do not have local user > accounts (meaning, local in the computer....they have the domain user > account objects). > > If you want to have different OUs and place the desired user account objects > in the appropriate OU in your new OU structure you can simply create and > link the desired GPO to the correct OU. > > How do you create a GPO and link it to an OU? There are basically two tools > for this: the ADUC and the GPMC. If you are using the ADUC MMC (Active > Directory Users and Computers) then you simply right click the OU in > question, select properties and then go to the Group Policy tab. There you > would click on new, give it a name (or, a Friendly Name in gpoesse) and you > have just created the GPO and linked it to that OU. Huh? But there is > nothing there. Correct, but you have created and linked. Now you need to > edit! So, click on the edit button and do your thing. Once you have done > this for this OU you would repeat the process for each OU. > > I might suggest that you check out the GPMC. It is a really neat tool. > There are lots of articles on this. Please note that once you install the > GPMC you will not be able to use ADUC for purposes of creating/editing GPOs. > The GPMC takes that role over for good once installed. > > Now, please understand that when you create and link the GPO that you have > performed two separate functions. You have created the GPO and then linked > it to the desired OU. That GPO exists in Active Directory. You can use > that same GPO and link it to several OUs. > > Does this help you? > > -- > Cary W. Shultz > Roanoke, VA 24012 > > "stosti" <sto***@discussions.microsoft.com> wrote in message > news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... > > Today I have a default group policy for all of my users. I created a > > different O.U. for each department. Now I would like a different group > > policy per O.U. Do you have instructions for doing this? > > > > Example I will set a different password policy per OU. > > > > Thanks, > > Scott > > > You are welcome.
However, what was not clear? You asked Jorge if you could do what I just clearly explained that you can not do. Or do you just need 'confirmation' from multiple people? That is usually a good thing. And an answer from an MVP should carry more weight than from someone who is not (but I used to be an MVP three months ago....just did not participate in the news groups that much in the last year). So, hopefully things are more clear for you. -- Show quoteHide quoteCary W. Shultz Roanoke, VA 24012 "stosti" <sto***@discussions.microsoft.com> wrote in message news:73989EA7-A221-4A14-96C5-BA710D55D762@microsoft.com... > THANK YOU for taking the time to explain this to me. I will just live > with > what I have for now... > > Thanks, > Scott > > "Cary Shultz" wrote: > >> Stosti, >> >> Bad choice for an example. You can have only one password policy per >> domain. You can not have a different password policy linked to each OU. >> This will not have the desired effect. >> >> Now, why did I write my response this way? Because you very much can >> have >> a password GPO and link it to each OU. However, it will not affect any >> domain user account objects that might be located in that OU. These user >> account objects are under the Scope of Management of the password policy >> set >> at the Domain level. What will fall under the Scope of Management of the >> OU-linked password policies would be any local user accounts of any >> computers that might also be located in these OUs. And, we are probably >> not >> interested in something like this. Users generally do not have local >> user >> accounts (meaning, local in the computer....they have the domain user >> account objects). >> >> If you want to have different OUs and place the desired user account >> objects >> in the appropriate OU in your new OU structure you can simply create and >> link the desired GPO to the correct OU. >> >> How do you create a GPO and link it to an OU? There are basically two >> tools >> for this: the ADUC and the GPMC. If you are using the ADUC MMC (Active >> Directory Users and Computers) then you simply right click the OU in >> question, select properties and then go to the Group Policy tab. There >> you >> would click on new, give it a name (or, a Friendly Name in gpoesse) and >> you >> have just created the GPO and linked it to that OU. Huh? But there is >> nothing there. Correct, but you have created and linked. Now you need >> to >> edit! So, click on the edit button and do your thing. Once you have >> done >> this for this OU you would repeat the process for each OU. >> >> I might suggest that you check out the GPMC. It is a really neat tool. >> There are lots of articles on this. Please note that once you install >> the >> GPMC you will not be able to use ADUC for purposes of creating/editing >> GPOs. >> The GPMC takes that role over for good once installed. >> >> Now, please understand that when you create and link the GPO that you >> have >> performed two separate functions. You have created the GPO and then >> linked >> it to the desired OU. That GPO exists in Active Directory. You can use >> that same GPO and link it to several OUs. >> >> Does this help you? >> >> -- >> Cary W. Shultz >> Roanoke, VA 24012 >> >> "stosti" <sto***@discussions.microsoft.com> wrote in message >> news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... >> > Today I have a default group policy for all of my users. I created a >> > different O.U. for each department. Now I would like a different group >> > policy per O.U. Do you have instructions for doing this? >> > >> > Example I will set a different password policy per OU. >> > >> > Thanks, >> > Scott >> >> >> Use the GPMC (http://www.microsoft.com/windowsserver2003/gpmc/default.mspx
and http://www.microsoft.com/downloads/details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en), create additional GPOs and link the GPOs to the OUs you created. It is not possible to configure password policies on an OU for users in a domain. The correct answer for this is: Password policies can only be configured at REALM level for the users within that REALM. What is a REALM? A realm could be a domain, a single server, a single client. For all mentioned, users can be created in the realm. For the domain you can create domain users and for single servers and clients you can create local users that belong only to the local server or client If you apply password policies at domain level the policies apply to domain users and local users on each server and client If you apply password policies at OU level the policies apply ONLY to the users of the servers or clients within that OU So if you want different password policies you need multiple domains OR you could use third party products that provides this functionality -- Show quoteHide quoteCheers, (HOPEFULLY THIS INFORMATION HELPS YOU!) # Jorge de Almeida Pinto # MVP Windows Server - Directory Services BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ----------------------------------------------------------------------------- * This posting is provided "AS IS" with no warranties and confers no rights! * Always test before implementing! ----------------------------------------------------------------------------- ----------------------------------------------------------------------------- "stosti" <sto***@discussions.microsoft.com> wrote in message news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... > Today I have a default group policy for all of my users. I created a > different O.U. for each department. Now I would like a different group > policy per O.U. Do you have instructions for doing this? > > Example I will set a different password policy per OU. > > Thanks, > Scott Thank You!
OK... If I remove the password policy from the top level can I put a password policy on each OU? Regards, Scott Show quoteHide quote "Jorge de Almeida Pinto [MVP]" wrote: > Use the GPMC (http://www.microsoft.com/windowsserver2003/gpmc/default.mspx > and > http://www.microsoft.com/downloads/details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en), > create additional GPOs and link the GPOs to the OUs you created. > > It is not possible to configure password policies on an OU for users in a > domain. > > The correct answer for this is: > Password policies can only be configured at REALM level for the users within > that REALM. > > What is a REALM? A realm could be a domain, a single server, a single > client. > For all mentioned, users can be created in the realm. For the domain you can > create domain users and for single servers and clients you can create local > users that belong only to the local server or client > > If you apply password policies at domain level the policies apply to domain > users and local users on each server and client > If you apply password policies at OU level the policies apply ONLY to the > users of the servers or clients within that OU > > So if you want different password policies you need multiple domains OR you > could use third party products that provides this functionality > > -- > > Cheers, > (HOPEFULLY THIS INFORMATION HELPS YOU!) > # Jorge de Almeida Pinto # > MVP Windows Server - Directory Services > BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx > ----------------------------------------------------------------------------- > * This posting is provided "AS IS" with no warranties and confers no rights! > * Always test before implementing! > ----------------------------------------------------------------------------- > > > ----------------------------------------------------------------------------- > "stosti" <sto***@discussions.microsoft.com> wrote in message > news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... > > Today I have a default group policy for all of my users. I created a > > different O.U. for each department. Now I would like a different group > > policy per O.U. Do you have instructions for doing this? > > > > Example I will set a different password policy per OU. > > > > Thanks, > > Scott > > > no.
Show quoteHide quote > It is not possible to configure password policies on an OU for users in a > domain. -- Show quoteHide quoteCheers, (HOPEFULLY THIS INFORMATION HELPS YOU!) # Jorge de Almeida Pinto # MVP Windows Server - Directory Services BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ----------------------------------------------------------------------------- * This posting is provided "AS IS" with no warranties and confers no rights! * Always test before implementing! ----------------------------------------------------------------------------- ----------------------------------------------------------------------------- "stosti" <sto***@discussions.microsoft.com> wrote in message news:23C6EE00-34CB-409B-A8D8-3EEEBA16FBF7@microsoft.com... > Thank You! > > OK... If I remove the password policy from the top level can I put a > password policy on each OU? > > Regards, > Scott > > "Jorge de Almeida Pinto [MVP]" wrote: > >> Use the GPMC >> (http://www.microsoft.com/windowsserver2003/gpmc/default.mspx >> and >> http://www.microsoft.com/downloads/details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en), >> create additional GPOs and link the GPOs to the OUs you created. >> >> It is not possible to configure password policies on an OU for users in a >> domain. >> >> The correct answer for this is: >> Password policies can only be configured at REALM level for the users >> within >> that REALM. >> >> What is a REALM? A realm could be a domain, a single server, a single >> client. >> For all mentioned, users can be created in the realm. For the domain you >> can >> create domain users and for single servers and clients you can create >> local >> users that belong only to the local server or client >> >> If you apply password policies at domain level the policies apply to >> domain >> users and local users on each server and client >> If you apply password policies at OU level the policies apply ONLY to the >> users of the servers or clients within that OU >> >> So if you want different password policies you need multiple domains OR >> you >> could use third party products that provides this functionality >> >> -- >> >> Cheers, >> (HOPEFULLY THIS INFORMATION HELPS YOU!) >> # Jorge de Almeida Pinto # >> MVP Windows Server - Directory Services >> BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx >> ----------------------------------------------------------------------------- >> * This posting is provided "AS IS" with no warranties and confers no >> rights! >> * Always test before implementing! >> ----------------------------------------------------------------------------- >> >> >> ----------------------------------------------------------------------------- >> "stosti" <sto***@discussions.microsoft.com> wrote in message >> news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... >> > Today I have a default group policy for all of my users. I created a >> > different O.U. for each department. Now I would like a different group >> > policy per O.U. Do you have instructions for doing this? >> > >> > Example I will set a different password policy per OU. >> > >> > Thanks, >> > Scott >> >> >> Stosti,
Didn't I just explain this? -- Show quoteHide quoteCary W. Shultz Roanoke, VA 24012 "stosti" <sto***@discussions.microsoft.com> wrote in message news:23C6EE00-34CB-409B-A8D8-3EEEBA16FBF7@microsoft.com... > Thank You! > > OK... If I remove the password policy from the top level can I put a > password policy on each OU? > > Regards, > Scott > > "Jorge de Almeida Pinto [MVP]" wrote: > >> Use the GPMC >> (http://www.microsoft.com/windowsserver2003/gpmc/default.mspx >> and >> http://www.microsoft.com/downloads/details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en), >> create additional GPOs and link the GPOs to the OUs you created. >> >> It is not possible to configure password policies on an OU for users in a >> domain. >> >> The correct answer for this is: >> Password policies can only be configured at REALM level for the users >> within >> that REALM. >> >> What is a REALM? A realm could be a domain, a single server, a single >> client. >> For all mentioned, users can be created in the realm. For the domain you >> can >> create domain users and for single servers and clients you can create >> local >> users that belong only to the local server or client >> >> If you apply password policies at domain level the policies apply to >> domain >> users and local users on each server and client >> If you apply password policies at OU level the policies apply ONLY to the >> users of the servers or clients within that OU >> >> So if you want different password policies you need multiple domains OR >> you >> could use third party products that provides this functionality >> >> -- >> >> Cheers, >> (HOPEFULLY THIS INFORMATION HELPS YOU!) >> # Jorge de Almeida Pinto # >> MVP Windows Server - Directory Services >> BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx >> ----------------------------------------------------------------------------- >> * This posting is provided "AS IS" with no warranties and confers no >> rights! >> * Always test before implementing! >> ----------------------------------------------------------------------------- >> >> >> ----------------------------------------------------------------------------- >> "stosti" <sto***@discussions.microsoft.com> wrote in message >> news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... >> > Today I have a default group policy for all of my users. I created a >> > different O.U. for each department. Now I would like a different group >> > policy per O.U. Do you have instructions for doing this? >> > >> > Example I will set a different password policy per OU. >> > >> > Thanks, >> > Scott >> >> >> Yes you did. I was hoping I misunderstood... I'm all set as I am. Thanks
for taking the time to answer! Another question for you... When a user changes there password and gets locked out is there any easy way to find out from what means or machine is the culprit? Thanks in advance! Show quoteHide quote "Cary Shultz" wrote: > Stosti, > > Didn't I just explain this? > > -- > Cary W. Shultz > Roanoke, VA 24012 > "stosti" <sto***@discussions.microsoft.com> wrote in message > news:23C6EE00-34CB-409B-A8D8-3EEEBA16FBF7@microsoft.com... > > Thank You! > > > > OK... If I remove the password policy from the top level can I put a > > password policy on each OU? > > > > Regards, > > Scott > > > > "Jorge de Almeida Pinto [MVP]" wrote: > > > >> Use the GPMC > >> (http://www.microsoft.com/windowsserver2003/gpmc/default.mspx > >> and > >> http://www.microsoft.com/downloads/details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en), > >> create additional GPOs and link the GPOs to the OUs you created. > >> > >> It is not possible to configure password policies on an OU for users in a > >> domain. > >> > >> The correct answer for this is: > >> Password policies can only be configured at REALM level for the users > >> within > >> that REALM. > >> > >> What is a REALM? A realm could be a domain, a single server, a single > >> client. > >> For all mentioned, users can be created in the realm. For the domain you > >> can > >> create domain users and for single servers and clients you can create > >> local > >> users that belong only to the local server or client > >> > >> If you apply password policies at domain level the policies apply to > >> domain > >> users and local users on each server and client > >> If you apply password policies at OU level the policies apply ONLY to the > >> users of the servers or clients within that OU > >> > >> So if you want different password policies you need multiple domains OR > >> you > >> could use third party products that provides this functionality > >> > >> -- > >> > >> Cheers, > >> (HOPEFULLY THIS INFORMATION HELPS YOU!) > >> # Jorge de Almeida Pinto # > >> MVP Windows Server - Directory Services > >> BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx > >> ----------------------------------------------------------------------------- > >> * This posting is provided "AS IS" with no warranties and confers no > >> rights! > >> * Always test before implementing! > >> ----------------------------------------------------------------------------- > >> > >> > >> ----------------------------------------------------------------------------- > >> "stosti" <sto***@discussions.microsoft.com> wrote in message > >> news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... > >> > Today I have a default group policy for all of my users. I created a > >> > different O.U. for each department. Now I would like a different group > >> > policy per O.U. Do you have instructions for doing this? > >> > > >> > Example I will set a different password policy per OU. > >> > > >> > Thanks, > >> > Scott > >> > >> > >> > > > for the password change thing see:
http://blogs.dirteam.com/blogs/jorge/archive/2005/11/24/161.aspx for troubleshooting account lockouts see: Enabling debug logging for the Net Logon service http://support.microsoft.com/?id=109626 -- Show quoteHide quoteCheers, (HOPEFULLY THIS INFORMATION HELPS YOU!) # Jorge de Almeida Pinto # MVP Windows Server - Directory Services BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ----------------------------------------------------------------------------- * This posting is provided "AS IS" with no warranties and confers no rights! * Always test before implementing! ----------------------------------------------------------------------------- ----------------------------------------------------------------------------- "stosti" <sto***@discussions.microsoft.com> wrote in message news:4266FE45-6F85-483B-A2BA-BB47E44CEE49@microsoft.com... > Yes you did. I was hoping I misunderstood... I'm all set as I am. > Thanks > for taking the time to answer! > > Another question for you... When a user changes there password and gets > locked out is there any easy way to find out from what means or machine is > the culprit? > > Thanks in advance! > > "Cary Shultz" wrote: > >> Stosti, >> >> Didn't I just explain this? >> >> -- >> Cary W. Shultz >> Roanoke, VA 24012 >> "stosti" <sto***@discussions.microsoft.com> wrote in message >> news:23C6EE00-34CB-409B-A8D8-3EEEBA16FBF7@microsoft.com... >> > Thank You! >> > >> > OK... If I remove the password policy from the top level can I put a >> > password policy on each OU? >> > >> > Regards, >> > Scott >> > >> > "Jorge de Almeida Pinto [MVP]" wrote: >> > >> >> Use the GPMC >> >> (http://www.microsoft.com/windowsserver2003/gpmc/default.mspx >> >> and >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en), >> >> create additional GPOs and link the GPOs to the OUs you created. >> >> >> >> It is not possible to configure password policies on an OU for users >> >> in a >> >> domain. >> >> >> >> The correct answer for this is: >> >> Password policies can only be configured at REALM level for the users >> >> within >> >> that REALM. >> >> >> >> What is a REALM? A realm could be a domain, a single server, a single >> >> client. >> >> For all mentioned, users can be created in the realm. For the domain >> >> you >> >> can >> >> create domain users and for single servers and clients you can create >> >> local >> >> users that belong only to the local server or client >> >> >> >> If you apply password policies at domain level the policies apply to >> >> domain >> >> users and local users on each server and client >> >> If you apply password policies at OU level the policies apply ONLY to >> >> the >> >> users of the servers or clients within that OU >> >> >> >> So if you want different password policies you need multiple domains >> >> OR >> >> you >> >> could use third party products that provides this functionality >> >> >> >> -- >> >> >> >> Cheers, >> >> (HOPEFULLY THIS INFORMATION HELPS YOU!) >> >> # Jorge de Almeida Pinto # >> >> MVP Windows Server - Directory Services >> >> BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx >> >> ----------------------------------------------------------------------------- >> >> * This posting is provided "AS IS" with no warranties and confers no >> >> rights! >> >> * Always test before implementing! >> >> ----------------------------------------------------------------------------- >> >> >> >> >> >> ----------------------------------------------------------------------------- >> >> "stosti" <sto***@discussions.microsoft.com> wrote in message >> >> news:C5B0F3B7-20A8-4F01-A57B-4B5881672B6A@microsoft.com... >> >> > Today I have a default group policy for all of my users. I created >> >> > a >> >> > different O.U. for each department. Now I would like a different >> >> > group >> >> > policy per O.U. Do you have instructions for doing this? >> >> > >> >> > Example I will set a different password policy per OU. >> >> > >> >> > Thanks, >> >> > Scott >> >> >> >> >> >> >> >> >>  
Thread options
Other interesting topics
DCs not Replicating
Certificate Authority is also a DC, want to demote? legacyExchangeDN - May I change it to a user? Netlogon / Sysvol Changing name or IP address on Domain Controller Group Policy - Shutdown/Startup Scripts Question Remove Dirty Boxes [WildPacket] Need help with global AD DNS server placement Domain redundancy DNS/Kerberos/LDAP integration question |
|||||||||||||||||||||||
