Revisiting and important question


A little while ago I posted about what is considered best practice with regards to the Default Domain Controller policies and Default Domain Policy.

http://blogs.technet.com/janelewis/archive/2007/04/24/just-don-t-do-it.aspx

At the time I was struggling to find some good examples to back up my post. However After some discussion internally some learned and  senior escalation engineers for Microsoft in the U.K. have  explained further the reasons why it is best advised NOT to unlink the Default Domain and the Default Domain Controllers Group Policy.

The summation the key points are below;

GUIDs for these policies are well known – the same in every AD domain and forest since we shipped Windows 2000.

Domain GPO GUID {31B2F340-016D-11D2-945F-00C04FB984F9}

DC GPO GUID {6AC1786C-016F-11D2-945F-00C04FB984F9}

The reason they are fixed is that internal API’s will have knowledge of what policy to update without having ascertain which ones are applying to the current Domain or Domain Controllers. Examples of these policies are LSA/SAM policy – the API’s allow in -memory (DS) policy, such as audit; privileges; password settings on a DC, to be set directly – the type of configuration information which you would normally expect to be read from Group Policy  at start up  and background refresh are examples of API’s that do this.

In order to keep LSA/SAM policy and Group Policy in sync there is a callback mechanism . When one is updated directly then the respective  Group Policy is updated too. if the Default Group Policies are unlinked then they will still be updated and replicated but obviously as they are  not read again at startup by other DC’s  the policy change is not reflected on those boxes. Another example of direct use of those Well Known GUID’s  is  that  Adprep explicitly sets ACEs on them.Customers do unlink these policies and run without experiencing related issues .Or indeed what could could be happening is that  they do not  notice, as the difference may be quite subtle. For example some users may be prompted to change their passwords after 20 days instead of  30 days.Customers need to be aware that there is a risk associated with doing so. Potentially something may break as a consequence of unlinking these policies.

It is therefore advisable to as I stated in a previous post.

“If you must use a different Group Policy for your Domain Controllers simply modify the order in which the Policies are being processed by having the Default Domain Controllers Policy running at a lower priority and your customised Domain Controller Policy running at a higher priority.”

Comments (47)

  1. rock says:

    Nice site. On your blogs very interest and i will tell a friends.
    http://www.hostingcoupononline.org/

  2. Hiece1971 says:

    What is the easiest way to find these types of weblogs online? The best method I possess is just following faves people have – likely to one bloggers "favorites" then the next writers favorites, and so forth..
    http://www.mytextyourexbackreviews.net

  3. Brenda says:

    Fantastic blog you have here. You’ll discover me looking at your stuff often. Saved!
    http://www.myeatstopeatreview.org

  4. jazz says:

    You are a very persuasive writer. I can see this in your article. You have a way of writing compelling information that sparks much interest.
    http://www.my3weekdietguide.com/

  5. David says:

    Really nice style and design and excellent content , nothing at all else we need : D.
    http://www.bestmusicalinstruments.net

  6. Ned says:

    You are a very persuasive writer. I can see this in your article. You have a way of writing compelling information that sparks much interest.
    http://mymagicofmakingupreviews.com

  7. nods says:

    Thnx for the treat! But yeah Thnkx for spending the time to discuss this, I feel strongly about it and love reading extra on this topic.
    http://www.realvenusfactorreview.org

  8. lawrencesmith says:

    This is really fascinating, You are a very professional blogger. I’ve joined your rss feed and sit up for searching for more of your great post. Also, I have shared your site in my social networks!
    http://www.myadonisgoldenratioreview.com

  9. acneno says:

    hi!,I like your writing very much! share we communicate more about your article on AOL?
    http://www.acnenomoreblog.org

  10. view web page says:

    When visiting blogs, i usually discover a very good content like yours
    http://www.myautobinarysignalsreview.org

  11. Ned says:

    Absolutely pent subject matter, appreciate it for selective information .
    http://www.webhostingonecent.org/

  12. myrasmith says:

    convincing and will definitely work. Still, the posts are very brief for starters. May you please extend them a little from subsequent time? Thanks for the post.
    http://www.my21daysugardetoxreview.com

  13. hesal says:

    Hello! I just wish to give an enormous thumbs up for the good info you will have right here on this post. I will likely be coming back to your weblog for extra soon.
    http://www.mypanicawayguide.org

  14. David says:

    you employ a wonderful blog here! do you want to cook some invite posts in my small blog?
    http://www.mytinnitusmiracleguide.com

  15. rosie.mayo says:

    An intriguing discussion might be priced at comment. I do believe you should write on this topic, it might certainly be a taboo subject but usually individuals are too little to speak on such topics. Yet another. Cheers
    http://www.mymi40xreview.com

  16. 3days says:

    There is some validity however I will take hold opinion until I look into it further. Good article , thanks and we wish extra!
    http://www.3daypottytrainingguide.org

  17. tyrion says:

    You are a very persuasive writer. I can see this in your article. You have a way of writing compelling information that sparks much interest.
    http://www.cruisecontroldietguide.com/

  18. hiecejes1991 says:

    You definitely put a brand new spin on a topic thats been written about for years. Great stuff, just great!
    http://www.thegetyourexbackguide.org

  19. John says:

    Just wanna remark on few general things, The website style is ideal, the topic matter is rattling good.
    http://www.hostingdiscountguide.com/

  20. chrisjesus91 says:

    Excellent beat ! I would like to apprentice whilst you amend your site
    http://www.magneticmessagingguide.org

  21. click for details says:

    I’ve joined your feed and stay up for seeking extra of your wonderful post. Also, I’ve shared your website in my social networks!
    http://www.bestpocketknifeguides.org

  22. visit here says:

    however what can I say http://www.besthostingdeal.org

  23. leahkhole says:

    When I originally commented I clicked the -Notify me when new comments
    http://www.manifestationmiraclereviews.org

  24. rsmit says:

    I am rather certain I’ll be informed plenty of new stuff proper right here!
    http://www.myyeastinfectionnomorereview.com

  25. Beetle9 says:

    It is pretty worth enough for me. In my opinion, if all webmasters and bloggers made good content as you did, the internet will be a lot more useful than ever before.
    http://www.bestepilatorguide.org

  26. DavidBush says:

    You ought to be a part of a competition for one of the highest quality information sites online. I’m going to recommend this website!
    http://www.militarydiettips.com

  27. DavidBush says:

    There are a couple of interesting points over time in this posting but I don’t know if I see every one of them center to heart. There may be some validity but I most certainly will take hold opinion until I consider it further. Excellent post , thanks
    so we want much more! Added to FeedBurner likewise
    http://www.thelanguageofdesirereview.org/

  28. morganel says:

    Hi this is a wonderful article. I’m going to mail this to my pals. I came on this while browsing on aol I’ll be sure to come back. thanks for sharing.
    http://www.besthostingoffer.org/

  29. rioe says:

    Perhaps there is that is you possibly can eliminate me from that service? Thanks!
    http://www.webhostingdecisions.com/black-friday-hosting-deals/

  30. billie says:

    I think that may be an enchanting aspect, it made me assume a bit. Thank you for sparking my considering cap.
    http://www.webhostingdecisions.com/cyber-monday-hosting-deals/

  31. Rachael says:

    Ultimately, a problem that I’m passionate about. I have looked for data of this caliber for the previous various hours. Your site is greatly appreciated.
    http://www.northlondongardenfencing.co.uk

  32. albakitty96 says:

    You need to take part in a contest for probably the greatest blogs on the web. I will advocate this site!
    http://www.howtostopblushing.net

  33. DJsmith says:

    I have not checked in here for a while as I thought it was getting boring, but the last several posts are good quality so I guess I will add you back to my everyday bloglist. You deserve it my friend
    http://www.internetslangs.net

  34. rosiesmith says:

    I like Your Article about – Gulvafslibning | Kurt Gulvmand Perfect just what I was searching for! .
    http://www.bluecubenetwork.com

  35. GoEmoji says:

    Thanks for ones marvelous posting! I actually enjoyed reading it, you’re a great author.I will be sure to bookmark your blog and will often come back at some point.
    http://www.goemoji.com

  36. smith says:

    been using these things. We appreciate you getting really accommodating and then for utilizing certain amazing themes most people are really desirous to be
    http://www.growtaller4idiotsblog.org

  37. Rachel Stott says:

    That’s really great deal you are going to do, Most of us keep following the same rules without objecting though sometimes its wrong not beneficial for everyone. But yes this should be done with a the availability of all attended of the county and you should
    arrange an event to make this decision successful.
    http://www.hampdenstateuniversity.com

  38. Rachel Stott says:

    The post is very interesting and amazing. I have enjoyed it so much..I will be waiting for the next post…
    http://www.oneidauniversity.com

  39. LetaErin says:

    I was suggested this website by my cousin. I am not sure whether this post is written by him as nobody else know such detailed about my trouble.
    http://www.status365.net

  40. Jsmith says:

    Hey There. I found your blog using msn. This is an extremely well written article. I’ll be sure to bookmark it and return to read more of your useful info. Thanks for the post. I’ll definitely comeback.

    http://www.topdronesforsale.org

  41. Emma says:

    Informative Site… Hello guys here are some links that contains information that you may find useful yourselves. It’s Worth Checking out….http://www.allifsccode.net

  42. rock says:

    Wow, superb weblog structure! How long have you been blogging for? you make blogging glance easy. The total look of your web site is excellent, neatly as the content material!
    http://www.realeportal.com

  43. rock says:

    I feel like I’m constantly looking for interesting things to read about a variety of subjects, but I manage to include your blog among my reads every day because you have compelling entries that I look forward to.
    http://www.servereast.net

  44. Transportation Services says:

    http://www.truckwalk.com/

    With the financial market all over the headlines these days, it’s easy to see why saving money on relocation is such a big deal. Thousands of mortgages are going bad, and those who once were able to pay these mortgages are finding themselves in debt and in
    need of a move.

    http://www.truckwalk.com/

    These two things simply do not fit together well, and even though some people might just be moving down the street, the need for cheap moving trucks is on the rise. Finding these trucks is not impossible, and if you get the right deal, your move can fall into
    your small moving budget. Here are some tips for finding the right online truck booking for your move in the modern financial market.

    http://www.truckwalk.com/

  45. latest govt jobs says:

    http://www.freejobalert.marwal.co.in/

    FreeJobAlert.com Job site is for Government,Sarkari Naukri,Banks,Railways,Police Recruitment, Results of IBPS,UPSC,SSC,RRB, Fresher IT Jobs and Walkins

    http://www.freejobalert.marwal.co.in/