Comments on: Default Domain Group Policy – What Should Be Configured?

By: Scott

Scott — Thu, 15 Feb 2018 04:38:12 +0000

I never actually read this anywhere, but it is something I have always done. It just seemed like common sense. Target GPOs appropriately, name them after what they do and don’t touch the default policies apart from stuff which can only be done there, like password policy.

By: Carl Webster

Carl Webster — Fri, 14 Oct 2016 13:28:36 +0000

In reply to Bill.

I would both backup the GPO (or all GPOs) and then save a report of the GPO so you have a record of all the settings. WOuld it be easier to recreate the policy or just remove the settings that shouldn’t be there?

Thanks

Webster

By: Bill

Bill — Wed, 12 Oct 2016 14:10:13 +0000

Looking at our default domain policy, we see that there are several entries beyond the defaults. We’re not sure if these have been made by programs or services that have been installed on the domain over time. If we reset our default domain policy to the defaults and then apply the account modifications that we have made and documented, are we able to restore the current policy if this change causes other issues?

By: Anon

Anon — Tue, 20 Jan 2015 11:46:29 +0000

There’s also this page that reflects this same MS advice:

Updating the Default Domain Policy GPO and the Default Domain Controllers Policy GPO
http://technet.microsoft.com/en-us/library/dd378987(v=ws.10).aspx

By: Carl Webster

Carl Webster — Mon, 16 Dec 2013 23:51:20 +0000

In reply to Emmanuel.

Start here – http://blogs.technet.com/b/askds/archive/2012/05/01/new-slow-logon-slow-boot-troubleshooting-content.aspx

Webster

By: Emmanuel

Emmanuel — Wed, 11 Dec 2013 09:54:57 +0000

hello Carl, Thank you so much for the useful information. However i have some queries which is related to this article.
1. I have only 1 PDC and about 15 users, some are using Win XP and others are using Win 7. The problem is it takes too long for logon and log off. I have been trying to troubleshoot this in vain.
2. There is only one GPO, which is the default one for all users in the DC. I have created “Staff” OU where i pull all users in here and then also there is a default GPO. However, in windows 7 clients, on the event viewer I got errors like “Periodic policy processing failed for user TRAINING\etessua in 16 seconds.” What could be the issue here? PDC is on W2k3.

By: IcI

IcI — Tue, 17 Sep 2013 09:31:39 +0000

Thank you. Most certainly useful.

You do have to question Microsoft though, why is this little nugget of information not clearly & boldly stated in any AD design document?

By: Prince C.

Prince C. — Mon, 12 Aug 2013 03:45:51 +0000

Bravo! And thanks for sharing. For, I am in the same shoes as you. I can’t begin to tell you how much I have argued that issue myself! Personally, I learned it a long time ago in one of my Windows 2000 training boot camp but for some reason, it stuck with me because I have had the privilege of building designing AD Forests in past and even present experiences. It is definitely refreshing to have something online and on the docs to refer would be doubters.

Regards,
Prince