Hi,
Since everyone seems to have differing oppinions this is almost turning
into FUD ;o)
It seems some of the responding people are knee-jerk-reacting to "you
can only put into effect account policy from the domain level". This is
correct in so far that "Domain Policy" will be applied towards Domain
Controllers, sitting in the Domain Controllers OU.
However, as others pointed out, the question was pertaining a MEMBER
SERVER and its local account database. You can apply this on OUs just
fine. The closest (the last GPO to be applied) will take precedence.
Ofcourse if you do apply a GPO on an OU level you need to be aware, that
it'd apply it on all contained objects - so move the server into a
seperate OU and link a new GPO with the account policy settings you want
and viola :)
As has been emphasized, the difference is between DOMAIN accounts (those
that sit on the DCs) and the LOCAL accounts (those that sit on the
individual member servers and workstations).
r@smus
.
Rasmus Rønlev
Copenhagen Business School, CBS-IT
RAMI KHANFER wrote:
You can not configure account policy on OU; the only place where you can
configure account policy is at the domain level.
Best Regards
Rami Khanfer
MobileCom - IT Direction/ Infrastructure Department
Mobile + 962 777 801539
Email Rami.Khanfer@mobilecom.jo
-----Original Message-----
From: Derick Anderson [mailto:danderson@vikus.com]
Sent: Thursday/October/2005 05:59 PM
To: Shabbar Arsiwala; focus-ms@securityfocus.com
Subject: RE: Account Lockout Policy
-----Original Message-----
From: Shabbar Arsiwala [mailto:sarsiwala@obleness.org]
Sent: Thursday, October 20, 2005 9:07 AM
To: focus-ms@securityfocus.com
Subject: Account Lockout Policy
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
We have an account lockout policy setup for users on our
domain Win 2K3 / Active Directory environment. 4 invalid
attempts the account locks out / 30 mins the account is
released. We would like to change this policy for one the
machines on our domain. This machine uses a local
administrator account to log in.
Is this possible ???
Thanks,
Shabbar
It is possible to change the *local* machine account lockout policy for
a specific machine, but not the *domain* lockout policy. To do this you
need to put your *domain* password policy in the Domain Controllers OU,
create a separate OU for this one machine, make a new policy with the
desired lockout settings, and link it to the single machine's OU. This
will only work for *local* accounts (such as MACHINE\Administrator), not
*domain* accounts (DOMAIN\Administrator).
Derick Anderson
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
