Changing Domain Password Settings via GPO

[dfresh]

What's the best way to go about implementing this change?

1. Just change the Default Domain Policy?
2. Create a new policy to reflect the new settings and apply it at the domain level?

Also if we have some accounts that have the box checked "Password never expires", such as critical systems workstations, will the GPO override this option?


TIA
Doug

[sluice]

You should change the default Domain Policy to reflect the new settings. Then create three new groups:
1. Deny_local_logon and apply deny local logon to that group
2. Deny_remote_logon and prevent remote access through Terminal Server
3. Service Accounts into which you put all the service accounts. Tick the box for password never changes for that group. That will override the higher level policy.
Put the Service accounts group into the other 2 groups.