daknetworks.com

All this time and I never covered this... GPO, gpupdate, gpresult, rsop

GPO

You know GPO, right? The Default Domain Policy is the applied for the entire domain and should override the rest. Put the password stuff in this policy but nothing else.

GPUPDATE

The GPO's will apply automatically but if you need to do it now:

gpupdate /force

gpupdate /force /target:computer

GPRESULT

To see what is being applied, type:

gpresult /r

It shows what server the system is connecting to, what GPO's are applying, what GPO's are not applying and what security-group is being applied. All useful information.

To see more info, use verbose mode:

gpresult /v

Note that the command will only show the USER gpo's. If you want to show the COMPUTER gpo's, the command should be run AS-ADMINISTRATOR.

Or if you need to run remotely:

gpresult /r /scope:computer

GROUPS

Groups are applied on login. If the group doesn't show, logout/login.

RSOP

Since GPO's can overlap, the follow will show what GPO's are winning in case they are fighting: rsop.msc

NET ACCOUNTS

Or a quicky to show password rules: net accounts /domain