How to reset security settings in the default Domain GPO in Windows 2000

This step-by-step article describes how to reset the default security settings in the Domain GPO. The Domain GPO uses a template, and, by default, it enables default security settings that are related to account policy only. None of the other settings are enabled initially. You can change these default settings by using the Group Policy Object Editor to modify individual settings in the Security Settings container under Computer Management\Windows Settings.

Sometimes, changing the default settings or enabling or disabling other settings may produce unwanted effects. This may result in a condition where unexpected restrictions exist on user accounts. If the changes are unexpected, or if the changes were not recorded so that you do not know what changes were made, it may be necessary to reset these security settings to their defaults.

This situation may also result if the contents of the Sysvol folder are manually rebuilt or if they are restored from a backup by using the steps that are included in Microsoft Knowledge Base article 253268: For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Reset the default settings in the Gpttmpl.inf file

Warning Use caution when you perform the following procedure because incorrectly configuring the GPO template may make your domain controller inoperable. Before you follow these steps, you must make a backup of the Gpttmpl.inf file. You must also make sure to edit the Gpttmpl.inf file under this specific GUID or path. Under another GUID, there is a similar Gpttmpl.inf file that controls user settings of the domain controller’s Group Policy settings.

1. Log on to Directory Services Restore mode.
2. Open the Gpttmpl.inf file with a text editor, such as Notepad. This file is located in the following folder, where sysvol path is the path of your Sysvol folder. The default path for the Sysvol folder is %SystemRoot@\Sysvol.
   sysvol path\domain name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit
3. To completely reset the security settings to the default settings, replace the existing information in the Gpttmpl.inf file with the following default information that you can copy and paste into your current Gpttmpl.inf file:
   

   [Unicode]
   Unicode=yes
   [System Access]
   MinimumPasswordAge = 0
   MaximumPasswordAge = 42
   MinimumPasswordLength = 0
   PasswordComplexity = 0
   PasswordHistorySize = 1
   LockoutBadCount = 0
   RequireLogonToChangePassword = 0
   ForceLogoffWhenHourExpire = 0
   ClearTextPassword = 0
   [Kerberos Policy]
   MaxTicketAge = 10
   MaxRenewAge = 7
   MaxServiceAge = 600
   MaxClockSkew = 5
   TicketValidateClient = 1
   [Version]
   signature="$CHICAGO$"
   Revision=1

4. Save the Gpttmpl.inf file.

Increment the GPO version

Increment the GPO version to make sure that the policy changes are retained. To do this, use one of the following methods.

• Method 1: Use Group Policy Object Editor
  1. Open Group Policy Object Editor.
  2. Make a change.
  3. Close Group Policy Object Editor.
• Method 2: Manually edit the Gpt.ini file
  
  To manually increase the GPO version, edit the Gpt.ini file that controls the Group Policy Template version numbers. To do this:
  1. Open the Gpt.ini file with a text editor, such as Notepad. This file is located in the following folder, where sysvol path is the path of your Sysvol folder. The default path for the Sysvol folder is %SystemRoot@\Sysvol.
     sysvol path\domain name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
  2. Increase the version number to a number that is large enough to guarantee that normal replication will not make the new version number become outdated before the policy can be reset. It is better to increment the number by either adding the number "0" to the end of the version number, or the number "1" to the beginning of the version number.
  3. Save the Gpt.ini file, and then close it.

Apply the new GPO

Apply the new GPO by using the Secedit tool to manually update the GPO. To do so, type secedit /refreshpolicy machine_policy /enforce at a command prompt, and then press ENTER. Then, check the application log in Event Viewer for Event 1704 to verify successful policy propagation.

Note After you perform this procedure, your previously configured Group Policy settings will be removed. You have to re-configure and re-apply these settings by using Group Policy Object Editor.

For more information about how to refresh Group Policy settings, click the following article number to view the article in the Microsoft Knowledge Base: For more information about how to reset user rights in the default Domain Controllers GPO, click the following article number to view the article in the Microsoft Knowledge Base: