If I create a GPO that enforces a password policy that is contrary to that of my Default Domain Policy, what happens?


The password settings in the Default Domain Policy always reign supreme when a user logs on to the domain. This prevents OU administrators from circumventing the domain password policy. However, if you choose to assign a password GPO to the OU level, it will enforce those settings when a user logs on locally to their computers. Jeremy discusses this thoroughly in Chapter 8 of his book. (Third edition, with the gear cover.)