http://cjhhotels.com/infotech

There's one serious pitfall when implementing Active Directory in Windows Server 2003.  If one fails to apply the solution prior to propagating the domain with user and computer objects, the result is a non-granular implementation of Group Policy as you will be left with having to use the Default Domain Policy for all objects.

As this particular issue has driven me nuts over the past few days, I am writing the solution down so that others who have succeeded in searching this document in the wild web will never have to fall into the same trap.

1. Raise the Domain Functional Level (Microsoft KB Article 322692 ). Make sure that you don't have Windows 2000 Domain Controllers when you do this.

2. Redirect New Users and Computers to an Organizational Unit. If you are stuck into finding what are the values to be filled so you can successfully run the redirusr and redircmp commands, use the command line tool "LDP" and then connect to your domain controller's IP address.

3. Join the computers to the domain and/or create your domain users

When you do the above steps in sequence, you will now have the leverage of the true power of Group Policy in Active Directory as you can create as many policies that can be tied up to Organizational Units as you see fit for your organization.

Fail to do this and you will end up trying to find out why your group policies for specific OUs don't propagate when you try to logon to the domain. This is especially tricky for the computer objects as you will need to recreate all previously joined accounts. As for the user objects, you simply just have to place the users into their respective OUs from the default User folder.

Email (will not be published)

Name

Title

Comment
 remaining characters

Post