CODEDIGEST InstallShield
Home Articles CodeDigest Tutorials InstallShield FAQs
Skip Navigation LinksHome » Article » Directory Service Article » How to manually create Default Domain GPO  Submit Articles and Win Geeky Prizes!!   You are not logged in.
Search
 

Sponsors
InstallShield
 

Product Spotlight
 

Technologies
 

CodeDigest Navigation
 

Technology News
No News Feeds available at this time.
 

Community News
No News Feeds available at this time.
 
How to manually create Default Domain GPO
Free Trial: InstallShield 2010 for Windows Installers Is InstallShield right for you? InstallShield handles your most complex installation requirements in minutes. Try it now.

By Nirmal Sharma
Posted On Mar 28,2008
Article Rating: (Login)
Be first to rate
this article.
No of Comments: 0
Category: Directory Service
Print this article.

Subscribe to our feed!

How to manually create Default Domain GPO

There is a way to create Default Domain GPO. There are two GPO created when you promote a member computer or a stand-alone server to domain controller.
These two GPOs are :

Default Domain Group Policy

Default Domain Controller Group Policy.

These GPO are stored in the SYSVOL folder. Netlogon service creates two permanent GUID for these two GPO under SYSVOL folder:
 
            \Windows\SYSVOL\sysvol\domain.com\policies\GUID
            Domain Default GPO GUID {31B2F340-016D-11D2-945F-00C04FB984F9}
            Domain Controller Default GPO GUID {31B2F210-016D-11D2-945F-00C04FB981F1}

 
Windows OS identifies default domain policies by its GUIDs located in SYSVOL folder. These GUIDs are unique for Default Domain Policy and Default Domain Controller Policy created by default.
 
You can use the following steps to create GPOs manually:
 
1. Open ADUC
2. Right click on Domain_name.com > Property
3. Switch to Group Policy tab
4. Create a policy named "Default Domain Policy" or you can rename it if you want. AD Tools queries default domain policies by their GUIDs located in SYSVOL folder and not by name.
5. Click this GPO > Property > note down the GUID of this GPO created.
6. Go to SYSVOL folder and change the GUID to default domain policy or default domain controller policy.
7. Next you need to use a small script using ADSI to set this unique GUID into GPT of this policy in AD database. You can also edit Schema manually to do so.

You can use the ADSI Snap-in to create the GUID in GPC of that GPO.


 
Here are some articles that you can use to troubleshoot Group Policy:

Troubleshooting Group Policy issues in Windows
http://www.microsoft.com/technet/community/columns/profwin/pw0502.mspx

How to reset security settings in GPO
http://support.microsoft.com/?kbid=226243

Scripting GPO
http://www.windowsitpro.com/Article/ArticleID/40231/40231.html?Ad=1

Using Dcgpofix.exe:
You can also use Dcgpofix.exe to restore Default GPO.

Have a look here for Dcgpofix.exe:
Dcgpofix.exe

The Dcgpofix tool does not restore security settings in the Default Domain Controller Policy to their original state
http://support.microsoft.com/?KBID=833783

You can contribute to CodeDigest.Com:
Donate to CodeDigest.com
Article Feedback
Title  
Submitted By  
Comment  
Enter the verification number
 
Comments