Windows Forum
What are the major ssues to Consider When Implementing Windows 2000 Group Policy?
I would liks some very specific considerations please.
by judy_p_1968
Windows 2000 Group Policies can be a complex matter, and there are many things to consider when implementing them. An introductory paper on the subject obviously cannot go into enough depth on this topic - here are just a few issues to consider:
Account Policies are domain-wide - In the Domain GPO, the three categories of settings under Account Policies - Password Policies, Account Lockout and Kerberos Policies - are defined on a domain basis only. This is a very important consideration - GPO?s for account settings defined for lower level OU?s WILL NOT WORK for domain users. Settings at lower level OU?s will take effect if users logon locally (i.e., using a local account) to a computer, but will not when logging on to the domain.
NoOverride and Block Inheritance Settings - In Active Directory, policies defined at higher-level OU?s are inherited, or "passed down," to child OU?s. When creating a GPO at a lower level, a "Block Inheritance" setting can be activated, which will prevent policies from being passed down from the parent OU. Conversely, a "No Override" option can be set on a GPO at a parent OU, which FORCES its policies to be set at the lower level OU. It is easy to see how this can quickly complicate the administration of the domain, and how difficult it can be to troubleshoot problems with Group Policies.
Microsoft recommends limiting the use of the No Override and Block Inheritance settings.
Policy Processing - It is important to understand how Windows 2000 processes policies. Policies are processed in a hierarchy:
1. Local GPO?s - these policies are local to a computer, which can be set on any Windows 2000 computer, regardless of its participation in a domain
2. GPO?s applied to Sites
3. GPO?s applied to the Domain
4. GPO?s applied to OU?s
by judy_p_1968
When policies are applied, they overwrite those previously applied. Considering the above order of precedence, policies applied at the local level will be overwritten by domain policies when joining the domain. Policies applied at the OU in which the user or computer is placed will be applied last (and therefore be implemented).
Implementing Account and Password Policies using Group Policy
The SANS Windows NT Step by Step describes how to implement security on an NT 4.0 server. Phase 4of this document demonstrates how strong password controls and secure accounts policies are implemented. Using the Step by Step as a guide, the following will describe how the same controls can be implemented in Windows 2000.
Creating new user accounts - Users are created in Windows 2000 using an MMC snap-in called Active Directory Users and Computers. As in Windows NT User Manager, the administrator can enable "User must change password at next logon," and disable "Password never expires" when creating new user accounts.
Setting account and password policies - To implement the settings as described in the SANS document, the Domain Group Policy Object must be modified. In the Active Directory Users and Computers snap-in, right-clicking on the domain and selecting Properties, Group Policy and Edit will launch the Group Policy Editor. Navigating to Computer - Windows - Security - Account Policies - Password Policies will allow the following account settings to be modified:
Maximum Password Age
Minimum Password Age
Minimum Password Length
Enforce Password History (equivalent to "Password Uniqueness" in the Step by Step)
Password Must Meet Complexity Requirements - this must be enabled if a password filter (such as PASSFILT.DLL) is used to enforce complex password requirements
Store Password Using Reversible Encryption - This should be DISABLED so that passwords remain encrypted!
by judy_p_1968
Navigating to Computer - Windows - Security - Account Policies - Account Lockout Policies will allow the following account settings to be modified:
Account Lockout Duration - this sets the amount of time, in minutes, that an account remains locked out. If administrators must reset locked accounts, this should be set to 0.
Account Lockout Threshold - this sets the number of failed logon attempts before an account is locked out
Reset Account Lockout Counter After - this value establishesa waiting period before resetting the account lockout counter. This setting forces a user, presumably an unauthorized user, to wait before another logon attempt can be made.
Additional Group Policy Settings
In addition to those previously discussed, there are a great deal of security settings that can be enabled using Group Policy. Many of these can be found by using the Group Policy Editor and navigating to Computer - Windows - Security - Local Policies. There are three categories of policies that can be set. The first is Audit Policy - audit can be enabled for many events, including logon and logoff, account management and policy changes. The second category is User Rights Assignment. In this section, an administrator can enforce rules on users and groups, such as "deny logon locally," "add workstations to a domain," and "log on as a service." Finally, the Security Options section provides a "catch-all" for many settings, such as "do not display last user name in logon screen,"automatically logging off users when sessions expire, and setting the logon message text.
This discussion is closed to new replies.
Sort by Trending