In Windows NT 4.0, Domain Security Policy referred to User Password, Account Policy, Audit Policy, and User Rights.

In Windows 2000, the Security Settings snap-in in the Group Policy Editor handles Domain Security Policy.

To configure domain wide security, use Active Directory Users and Computers, right click the domain object, and press Properties. On the Group Policy tab, you can see the linked GPOs. If Default Domain Policy is not linked, Add it. Edit the Default Domain Policy.

If you navigate to Computer Configuration\Windows Settings\Security Settings, the following nodes can be used:

Account Policies                                 Password Policy                                 Account Lockout Policy                                 Kerberos Policy                              Local Policies                                 Audit Policy                                 User Rights Assignment                                 Security Options                               Event Log                              Restricted Groups                              System Services                              Registry                              File System                              IP Security Policies on Active Directory                              Public Key Policies
Group Policy is configured via GPOs in a heirarchy such as Sites, Domain, or Organizational Units and applied in a LSDOU order:


The later policies take precedence over earlier applied policy.

Local policy is applied first. When this conflicts with a Domain policy, the Domain policy prevails.