Need default GP for 2008 R2 Server

[andy_whitlock]

I upgraded my domain schema and functional levels, integrated a 2008 R2 server which replicated all the domain things from the old (2000) server. I want to write the group policies from the ground up - there seems lots of nice features in 2008 R2.

 

Does anyone have the default domain policy / default domain controller policy for a vanilla 2008 R2 server?

 

I've got the starter group policies for Users / Computers which are provided by 2008.

 

Also any advice on using XP clients with 2008 R2 when setting policies?

 

 

 

Thank you for your help in advance!!

[teejay]

If you create a new policy and select the Vista policy as the template that will give you a good base to start from. Sorry to be so vague, but the rest of the policy is really dependant on the school setup.

[andy_whitlock]

I'm ok with building the computer / user policy from the ground up - it's just the default settings which are in the "default domain policy" and "default domain controller policy" which I need.

 

Was unsure if there were many incompatibilities with XP clients (I guess my post was covering two topics - sorry)!

[teejay]

I'm ok with building the computer / user policy from the ground up - it's just the default settings which are in the "default domain policy" and "default domain controller policy" which I need.

 

Was unsure if there were many incompatibilities with XP clients (I guess my post was covering two topics - sorry)!

 

Back up your current ones and then right click an select reset, which will set them to the defaults for 2008.

[andy_whitlock]

Genius, well that's a nice tidy feature if it work as one would expect - thank you!!

[teejay]

Hic, not bad when I've drunk far too much ale tonight, lol

[jsnetman]

I always thought it was best not to tinker with the default domain policy apart from on 2003 to set the password policy. If you want to control servers by group policy then I would make a new OU and link it to a new set of group policies and move the servers into that. After all the default domain policies affects all machines there will be certain times when you don't want any type of group policy control. On any network I have set up I have never altered the default domain policy apart from password control. The default domain controller policy should already exist on any network with active directory.

[andy_whitlock]

I agree it's best not to tinker with these defaults - however the previous techie / network manager / IT monkey decided to!!

 

Unable to find this reset button too, really need to wipe the rubbish and just leave the essentials - further pointers?

[teejay]

Oops, msidirected you there! It's done from the command line:

dcgpofix /target:Domain
dcgpofix /target:DC
or
dcgpofix /target:both to do both at the same time.