Default Domain Policies

Question

By default, two polices are created when you dcpromo a server: Default Domain Policy, and Default Domain Controllers Policy. These polices should have guids of {31B2F340-016D-11D2-945F-00C04FB984F9} and {31B2F210-016D-11D2-945F-00C04FB981F1} respectively. However, in my 2003 domain, someone had renamed the default domain policy and put a new one named "Default Domain Policy". To make things worse, the Default Domain Controller Policy is missing but a new policy called "Default Domain Controllers Policy" is in its place. I currently have the following:
Default Domain Policy -> {C0C9ADF5-8E49-499C-87B2-2804931871DA}
Default Domain Policy - Disabled Original -> {31B2F340-016D-11D2-945F-00C04FB984F9}
Default Domain Controllers Policy -> {6AC1786C-016F-11D2-945F-00C04fB984F9}
I do not have backups of the original policies. I suspect the polices have been in this state for at least a year if not longer.
What is the impact of leaving the policies in their current state?
Should I attempt to restore the original policies using dcgpofix.exe?
Will using dcgpofix cause any issues with my Exchange 2003 or SMS 2003 environments?
Thanks,
Sean

Answer 1

Hi,
The default policies created by the system should be:
Default Domain Policy
{31B2F340-016D-11D2-945F-00C04FB984F9}
Default Domain Controllers Policy
{6AC1786C-016F-11D2-945F-00C04fB984F9}
These two policies are built-in policies that define default settings applies to domain users and computers.
In this issue, I’d like to know whether the original Default Domain Policy is still linked to the domain or not. If yes, it will be OK even though it is renamed.
Regards,
Miles Li
Microsoft Online Community Support