There is a GPO policy running on the domain level. It contains settings for password policy and the account lockout policy on the domain level. The GPO link is disabled, but the guy who disabled it says that domain policy for password and account lockout settings will be applied to lower containers and will propagate down regardless whether it is disabled or not. Seems a bit strabge to me. Would you agree with his statement?

Hello, The Default Domain Policy (if that is what you are referring to) should be "Enabled" for it to apply.Isaac Oben MCITP:EA, MCSE