Newsgroup: it.comp.os.win.win2000
Titolo: MCSE 70-215: Criteri di gruppo HELP!

Vi sottopongo un test che mi sta facendo diventar matto:
You are the network administrator for your company's corporate LAN. You have
created a Group Policy Object (GPO) for an organizational unit (OU) named
Sales that forces its members to changed their password every 21 days. The
default domain policy forces users to change their password every 14 days. A
user named David is a member of the Sales OU logs on to a Windows 2000
Professional computer. The site in which this computer resides has a GPO
attached to it that forces user to change their password every 10 days. The
local security policy for the computer that David is logging on to forces
users to change their password every eight days. David receves a message as
he is logging in that his password has expired and must be changed.
How many days has it been since David last changed his password?
La mia risposta č 21 dato che la gerarchia č:
sito (10gg) -> dominio (14gg) -> OU (21gg)
Il test invece propone come soluzione corretta 14 dicendo che:
User account policies are only applied at the domain level. All other
account policies that may have been set for a site, OU or for a local
computer are dismissed.
Qualcuno sa spiegarmi il perché?
Doc.

 Qualcuno sa spiegarmi il perché?
Perché è esattamente così: il sistema operativo applica le policy relative
agli account *solo* a livello di dominio.
È una precisa scelta di Microsoft.
Massimo

, 
docd...@yahoo.com
 
says...

Perche' tutte le Policy che hanno a che fare con la Security (come 
appunto la durata delle password) hanno valore solo se applicate a 
livello di Dominio.
"Domain controllers pull some security settings only from group policy 
objects linked to the root of the domain. Because domain controllers 
share the same account database for the domain, certain security 
settings must be set uniformly on all domain controllers. This ensures 
that the members of the domain have a consistent experience regardless 
of which domain controller they use to log on.
Windows 2000 accomplishes this task by allowing only certain setting in 
the group policy to be applied to domain controllers at the domain 
level. This group policy behavior is different for member server and 
workstations.
 
The following settings are applied to domain controllers in Windows 2000 
only when the group policy is linked to the Domain container:
 
 - All settings in Computer Configuration/Windows Settings/Security
  Settings/Account Policies (This includes all of the Account Lockout,
  Password, and Kerberos policies.)
 
 - The following three settings in Computer Configuration/Windows
  Settings/Security Settings/Local Policies/Security Options:
 
    - Automatically log off users when logon time expires
 
    - Rename administrator account
 
    - Rename guest account"
Si suppone che David faccia logon al dominio, e non alla W2K Pro, 
perche' altrimenti ...
"For example, if a Windows 2000-based workstation is in an 
organizational unit named OU1, an administrator could create a Group 
Policy object for OU1, and specify an account policy that is different 
from that of the default domain policy. In this case, when a user logs 
on to the domain, the account policy settings from the default domain 
policy are in place. When a user logs on locally to the Windows 2000-
based workstation, the local account policy as defined by the Group 
Policy object for OU1 is used."
Pero' la password che dovrebbe cambiare, facendo logon alla W2K Pro, 
sarebbe quella del suo utente locale, e non quella del dominio.
-- 
________________________________________________
Roads? Where we're going we don't need .. roads!
Where are we? When are we!  
________________________________________________

 livello di Dominio.
[...]
Grazie ragazzi siete stati molto chiari :)
Doc.