Originally posted here by ammo
Ok, I think I see what's going on here:

When SawPer and I are refering to "Account Policies", we are refering to the policies (in gpedit.msc) under "computer configuration | Windows Settings | Security Settings | Account Policies" under which are defined the "password policy", "account lockout policy" and such.

I believe that you took it to mean the "User Configuration" (as opposed to the "Computer Configuration") section of policies.

Did I get you right?


Ammo
Yepp, heh!!
It is really confusing with the "Account Policies" settings only being effective from the Domain level. I wonder if you don't set any "Account Policies" settings at all on the Domain level, if you then can set them on the OU level??? That might be a good workaround to be able to set different settings for different users?!?

Or maybe you can ONLY set the "Account Policies" on the Domain level period??

Don't know if I wanna test that on my network.. heh.. ?! Anyone got a lab to test this?