Printable View
I am using Windows 2003 Domain and have domain policies applied on domain level such as the lockout policy. There are some accounts that have domain admin right. How can I exclude these admin accounts from Account Locked out policy or other domain policy? Thanks.
You can try to create a new policy and dont use the domain policy for this. After that inn the GPO properties choose deny read and apply GPO to members of that group.
The other way - Create an OU and just set it to block policy inheritance. Make sure the Domain level policy is not set to No override. Using this the new OU doesn't have any policy applied.
Check the below link for locking out default domain admin:
http://blogs.dirteam.com/blogs/jorge...21003F00_.aspx