Active Directory Best Practices 24 seven Migrating, Designing, and Troubleshooting phần 4

Cũng như với Active Directory mọi đối tượng khác, bạn nên xác định một chiến lược đặt tên cho các trang web và các liên kết trang web. Một tên của trang web nên đại diện cho các vị trí vật lý mà trang web đại diện. Các vị trí có thể đại diện cho một vị trí địa lý cho các tổ chức có văn phòng khu vực | 92 chapter 5 organizational unit design cannot be overridden. This is the reason that a separate domain needs to be created if any settings within these options need to be different between user accounts. As a general rule you should not make changes to the Default Domain Policy with the exception of setting the security policy options settings. If any settings will define corporate standards other than the security policy settings and you want to apply them at the domain level create a new policy for these settings. Although this goes against the recommendation that you use the fewest GPOs possible it will allow you to have a central point to access the security policies for the domain and separate any other policy settings that are applied. Another reason is that this gives you the ability to recreate the Default Domain Policy if it becomes damaged. Included with Windows Server 2003 is a utility called . This command line utility will re-create the Default Domain Policy and the Default Domain Controller Policy if necessary. It will not create either policy with any modified settings it will only re-create the policy with the initial default settings that are applied when the first domain controller in the domain is brought online. Keeping this in mind only make changes to the security settings that are applied to either of these two policies and make sure the settings are documented. After running the settings that define the corporate security standards can then be reset. If you were to add settings to the Default Domain Policy and then run the settings would be lost and you would have to re-create them. However if you were to create a new Group Policy and add the settings to it instead when the Default Domain Policy is re-created the new Group Policy would not be affected. The same rule holds true for the Default Domain Controllers Policy. Because some settings should be applied to domain controllers to ensure their .