Hello,
Ive been trying to figure out this issue with my GPO's,
What I initially wanted to do was create a simple password policy. I go to the GPMC and edit the Default domain policy and open Computer configurations >windows setting> security setting >and Account Policy is missing.
However i can see the Default domain policy settings specifications with everything im looking to change under settings. I dont know what can be the issue if its appearing under the settings.
@KrisC5 You should create the PolicyDefinitions folder inside the Policies folder, which would be c:\windows\sysvol\domainname\policies\policydefinitions. (The other paths should be the same content-wise ) Inside the policydefinitions folder, you copy all the admx files and the en-us folders (And other languages if needed) containing the adml files. This should look something like this : (Both from domain and local path, same folder)
If you reopen the Group Policy editor and edit the policy, you should see the Account Policies folder inside the GPO.
Yes thats the path i mentioned, they are in the policies folder, but still it is not creating a central store. i have the downloaded Policy definitions with all the language and ADMl/ADMX files still in that folder
I'm sorry, I didn't read it correctly. Although it's a good idea to have the central store in your Policies folder... You can only set the Password Policy setting at the Domain Level 🙂 --> https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/accoun...
Each domain can have only one account policy. The account policy must be defined in the default domain policy or in a new policy that is linked to the root of the domain and given precedence over the default domain policy, which is enforced by the domain controllers in the domain
And you are editing that one... This is strange?! Is the GptTmp.inf missing? Do you see the file in this location?
Should contain something like this:
[Unicode]
Unicode=yes
[System Access]
MinimumPasswordAge = 1
MaximumPasswordAge = 42
MinimumPasswordLength = 7
PasswordComplexity = 1
PasswordHistorySize = 24
LockoutBadCount = 0
RequireLogonToChangePassword = 0
ForceLogoffWhenHourExpire = 0
ClearTextPassword = 0
LSAAnonymousNameLookup = 0
[Kerberos Policy]
MaxTicketAge = 10
MaxRenewAge = 7
MaxServiceAge = 600
MaxClockSkew = 5
TicketValidateClient = 1
[Registry Values]
MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=4,1
[Version]
signature="$CHICAGO$"
Revision=1
ok, so does the domain need to point to the server that is DC, because we currently dont.
I ask be cause this article states that serverhostname alone can be used to house the sysvol folder, wheather that be same case, in regards to creating a central store, i dont know. but id assume so.
https://www.minitool.com/lib/sysvol.html
An yes I can find that file, with all those fields .Also on a separate note, when on a local workstation, and going to the device "local Security setting" i can see Account policy there, but cant edit.
no dice, it gave me an error parameter is incorrect. but distinguished what i wanted to do
