I have posted on this subject before. Everyone here seems to say that subdomains do not inherit any GPOs from their parent domains. Now I am studying a book that implies that there is a connection between parent and subdomains with respect to Group Policy. Does anyone have a definitive answer on this.

__________________
The Computer is a creation of man. Man is a creation of God! -
Joe from Brooklyn

Report this post to a moderator

When a GPO is applied to the domain level, it affects all the users and computers belonging to that particular domain. With that said, GPOs don't flow from parent to child domain.

Report this post to a moderator

TechRanger,

Slinky is right, GPO's don't flow from parent to child domains.
Some technical information about :

Deciding When to Create a Domain
To put Windows 2000 into service, your company will require at least one domain. Because Active Directory can handle millions of objects and span multiple sites, one domain might be sufficient for your needs. You might consider creating additional domains in order to accomplish one of the following goals:

Delimit security. A Windows 2000 domain defines a security boundary. Security policies and settings (such as administrative rights and access control lists) do not cross from one domain to another. Active Directory can include one or more domains, each with its own security policies.
Apply Group Policy. A domain defines one possible scope for policy (Group Policy settings can also be applied to OUs or sites). Applying a Group Policy object (GPO) to the domain establishes how domain resources can be configured and used. For example, you can use Group Policy to control desktop settings, such as desktop lockdown and application deployment. These policies are applied only within the domain and not across domains.

For more information:
http://www.microsoft.com/technet/tr...oy/febdesad.asp

P.S. There's a lot of information on Technet about AD.

{}'s

Report this post to a moderator

Yes in brief, a domain is a security and administrative boundary.

Each domain has it's own unique 'Default Domain Policy'.

You can of course, apply GPO across domains, but it is not recommended for performance reasons.

Report this post to a moderator

If you modify the default domain policy of the root domain of the forest before creating a subdomain, will the subdomain receive the modified GPO or a fresh default policy?

__________________
The Computer is a creation of man. Man is a creation of God! -
Joe from Brooklyn

Report this post to a moderator

Should just be a fresh policy...

Report this post to a moderator

I finally figured out why my book talks about subdomains and inheritance of GPOs: subdomains do inherit GPOs from sites. Of course, the same is true for domains.

__________________
The Computer is a creation of man. Man is a creation of God! -
Joe from Brooklyn

Report this post to a moderator

quote:

---

Originally posted by Tech Ranger
I finally figured out why my book talks about subdomains and inheritance of GPOs: subdomains do inherit GPOs from sites. Of course, the same is true for domains.

---

Report this post to a moderator

That is a very clear outcome from your original query. Great thread.

Report this post to a moderator

As domains are security bounderies, subdomains don't inherit GPOs from parents

Report this post to a moderator