MCITP: Windows Server® 2008 Enterprise Administrator, Study Guide

6.6. Working with the Default Domain Policy and Domain Controllers Policy

The first rule of thumb when working with the default domain and domain controllers policies is as follows: don't do it unless absolutely necessary.

In any enterprise that is going to require ongoing updates to Group Policy, you want to strive to not change this crucial portion of your network. Alternatively, you can create a domain policy that overrides the default domain policy and implement changes on this. This means that any additions you make to this new policy won't affect your settings.

Keep in mind that the default domain policy is the policy that is created as soon as an administrator logs on for the first time. It contains account policy settings, password policies, ...