Where do I set Policies?

[drewmaztech]

I am looking to start working with our Active Directory Group Policy settings. I know to go about it carefully. I'm well aware they can wreak havoc.

Is it better to set the Group Policies at the "Default Domain Policy" or at "Default Domain Controller Policy"? Since I'm on that subject - what is the difference between them, anyway?

Anyone also know of a good guide to what each setting does? I look at the 300something settings and I'm not sur exactly what each one is.

THANKS

[corturbra]

Best bet? Setup a test policy and leave the default policies alone until you're comfortable with what the effect of the settings will be.

When we need to test something here, we have a test group called policy with test users in. Once happy we apply to a live policy, but we never use the default just in case we need something to go back to.

I don't know of any one site where it's all explained, but go through and look into a policy setting, there is an 'explain' tab which gives fairly good info.

There will be a few funnies though, e.g. restricting a user so they can't change internet LAN connections, will prevent you from applying your own internet LAN settings. Trial and error.....

[CeeBee]

You want to look at the domain policy for clients and DC policy for your DC's. And yes, add a new policy for whatever settings you want to add.