Policy Domain

How do I edit the domain policy in Server 2003 to enforce SUS as the update server?
just like the question says. I am not sure how I am supposed to do this. I am in the GPO but am not sure what do do after that really.

"To point the client computer to your WSUS server 1. In Group Policy Object Editor, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Windows Update. 2. In the details pane, double-click Specify intranet Microsoft update service location. 3. Click Enabled, and type the HTTP URL of the same WSUS server in the Set the intranet update service for detecting updates box and in the Set the intranet statistics server box. For example, type http://servername in both boxes. 4. Click OK."

Where can I get the Yahoo contact address concerning a policy to keep my domain accessible after I have died?
I am 67 and in poor health. I would like my web site to be accessable to the public after I have died. Does Yahoo have a insurance policy to make that possible? Yahoo is my domain provider.

I think I understand that you might want to have some sort of immortality, to be remembered as having lived BUT I don't think the net is the way to do this. I think we as people want to leave our mark & be remembered down the ages as not only being here but making a difference

how can i apply path rule in software restriction policy for a domain users?
i can restrict some software locally by entring its path on my computer , but how can that be for a whole domain or OU?

1- start active directory users and computers on your domain server. 2- right click on domain name an select properties. 3- go to Group policy tab. 4- click New to define your policy

Default Domain Security Policy VS Default Domain Controller Security policy?
I just want to know what the difference is between the two. I am setting password and account lockout policies and want to know under which one to set them. If I remember correctly it would be under Default Domain Security Policy. Please advise if you know.

Default Domain Security Policy will affect everyone that logs into your domain. The Defaul Domain Controller Security if for any users that have access to log into your domain controller as a local user. The security policy only affects the Domain controller as a machine, and not the entire domain.

How can I limit where domain users can save files on their computer using active directory policy?
We want to force users connecting to a domain to save personal files (doc, word, excel) to their network drive. How can we prevent them from saving files to their desktop and/or My Documents, etc.

To prevent normal users from saving to a folder i.e. their desktop, you could run the following command: %LOGONSERVER%\Netlogon\xcacls "%USERPROFILE%\Desktop" /P "%USERDOMAIN%\%USERNAME%":RX Administrators:F System:F /Y note: you will need xcacls to do this. You can get this from MS here: http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/xcacls-o.asp For a bit more info on this you can go here: http://www.petri.co.il/forums/showthread.php?p=549#post549 I strongly recommend that you look at the MS Group Policy white papers: http://technet2.microsoft.com/WindowsServer/f/?en/library/b9cb929b-4c2f-4754-ad31-d154bb8105771033.mspx There's a TON of great info on this site. I'm sure you'll find what you need there. Best of luck!

Setting to prevent administrators from overiding the domain policy for user accounts? (e.g., Password Expiry)
Is there a setting to prevent administrators from overiding the domain policy for user accounts? (e.g., Password Expiration) For example, if the domain policy sets passwords to expire in 90 days, it's still possible to set user passwords to not expire. Is there a way to enforce the domain policy and not allow individual user settings? This is for Active Directory 2003.

If you're the domain administrator, yes, both of these are very possible to do. I don't feel this is the case, but here's how one would do it: Open Active Directory Users and Computers and locate the user you want to set to not expire their password. Double-click their account name, select the account tab and set "Password never expires" or something similar to that. (I don't have it opened here). If you want a user to not receive GPO's, you can set a different Organizational Unit (OU) to hold those users with different policies. You cannot set different password policies such as length, password aging, and reversible encryption, etc to these GPO's, as those are domain wide. However, you can also set a specific GPO to apply computer only settings and/or user only settings. AD doesn't allow you to add GPO's to the default containers of Users and Computers, so if you want the domain policy itself to apply to the users/computers and nothing else, leave those accounts there and create another OU/GPO for others. Finally, from Microsoft: "If you run any version of Windows® domain today (Windows NT®, Windows 2000 Active Directory®, or Windows Server® 2003 Active Directory), you are limited to a single password policy per domain." See link, which has much more information about this and how to effectively use password policies. WG

How long are domain policies cached on the client?
I've set it up so that our branch (about 10 miles away) can connect to the main office via a VPN connection and has successfully connected to the main office's domain, logged in as a user and picked up the associated Group Policy (GPO). The GPO for that account at the Branch may change once or twice a year at most. Since I have no use for the VPN until a policy change is made, do I have to worry about the locally cached domain account and associated GPO expiring anytime soon and denying the user the ability to log in?

The GPO won't expire any sooner from a cache because it will still have to authenticate on the server. If you set your GPO to where it expires after the user fails to login for so many days, and your users don't use the domain that often, then you probably don't have the best configuration.

MS Windows Server 2003 Domain Policy: What makes it update on clients?
I'm studying for the 70-290 MCSA exam, and I'm experimenting with domain policies. First, my set up: A windows server 2003 server as the domain controller (active directory), with a windows xp client on the domain. Experiment: Enable account lockout policy so that 3 invalid login attempts will lock the account out. I did this through the "Domain Security Policy" admin tool. Then on the client, I tried to login several times using an invalid login. No message saying it was locked out. I then enabled account lockout in the domain controller security policy (I'm not 100% sure, but does this only affect the domain controller and people logging into the DC not the domain?). same thing on client: no lockout. So, I sat and read more about it without much success. I tried again on the client, and it locked out after 3 more attempts. Does it take time for the policy to propagate to clients? I would have expected it would have been instantaneous as it checks the login? What am I missing? When does the client update? When does the domain policy become active? Or, how do I do it (maybe I did something by mistake which activated it?) Thanks

There is a cycle time for machines in the domain to get GP updates. You can set the time at the server. I forget what the default value for the time is, but you could look it up. Is the lockout setting a computer setting or a user setting? If it is a computer setting, then logging out will not renew the GP. You would have to reboot the machine or wait for the timer cycle. In general you don't want to edit the default domain policy. It's a better idea to create a new GPO for the particular function you want. Much easier to keep track of what's happening.

How i set group policy in my domain using GPMC.
in windows server 2003

A good step-by-step video on how to deploy a group policy is availble here: http://i.cmpnet.com/nc/1705/video/group_video.html

difference: domain controller security policy,domain security policy,local security policy?


Domain policies are managed from Domain Controllers (Servers) a number can managed these policies. Local policies are local to the specific machine (PC/laptop etc). Local and Domain policies are generally the same in settings/options available to keep a standard of settings throughout the Domain or Local Network. They are also customisable by adding AMD or AMDX Templates for different applications such as IE7 and Office 2007 etc. Domain policies are a great way of locking down entire networks, certain groups, or even indivdual PCs to stop users messing with settings and even deploying applications. In Windows XP the Local Policy settings applied to 'ever' user who used the PC. Now in Windows Vista the Local Policies can be applied to a local group or indivdual set of users. You should have a good understanding of Workgroups and Domains to get a basic understanding of the key words in the question.