Does anyone have an authoritative source of policies that, if set, MUST be set within the Default Domain Policy (if one chooses to set them)? Off the top of my head, I know that password policies and certain user session policies must be set within the Default Domain Policy. I'm doing a cleanup of our Domain GPOs and trying to separate any GPs that can be set outside the default...
To clarify, I am not asking what policies must be set, I am asking which policies, should I choose to set them, must be set within the Default Domain Policy.
The settings you're looking for are enumerated in Group Policy application rules for domain controllers, insofar as how Domain Controller (DC) computers apply Group Policy Object (GPO) settings that are set at the domain level. You don't necessarily need to specify these settings in the "Default Domain Policy" (and, indeed, I would recommend not modifying the "Default Domain Policy"). Rather, the resultant set of these settings, based on the link order of the GPOs at the root of the domain, determines the effective setting the DCs will apply.
The settings include the following for all Active Directory DCs.
Windows Server 2003-based DCs (and, presumably, Windows Server 2008 and 2008 R2-based DCs) will also apply the Security Options settings:
According to Microsoft training books the Default Domain Policy should only contain settings for password,account lockout, and kerberos policies. The Default domain controllers policy should contain your auditing policies.
Changes in settings to domain security policy should always be made to the Default Domain Policy GPO.
Changes in settings to domain controller security policy for User Rights Assignment and Audit Policy must be made to the default GPO, rather than to a newly created GPO.
Default Domain Policy: Password Policy, Account Lockout Policy, Kerberos Policy.
Default Domain Controllers Policy: Audit Policy, User Rights Assignment, Security Options, Event Log Policy.
Applies To: Windows Server 2003/2008 & R2
There are no settings that are required to be defined in the default domain policy. In fact it's best practice not to touch the default domain policy and the default domain controllers policy.