[SSSD] [PATCH] AD GPO: Change default to "enforcing"

Jakub Hrozek jhrozek at redhat.com
Thu May 28 09:19:44 UTC 2015


On Mon, May 11, 2015 at 01:22:08PM +0200, Jakub Hrozek wrote:
> On Mon, May 11, 2015 at 12:41:12PM +0200, Jakub Hrozek wrote:
> > On Mon, Apr 20, 2015 at 11:48:00AM -0400, Stephen Gallagher wrote:
> > > When a user enrolls a system against Active Directory, the expectation
> > > is that the client will honor the centrally-managed settings. In the
> > > past, we avoided changing the default (and left it in permissive mode,
> > > to warn admins that the security policy wasn't being honored) in order
> > > to avoid breaking existing Active Directory enrollments.
> > > 
> > > However, sufficient time has likely passed for users to become
> > > accustomed to using GPOs to manage access-control for their systems.
> > > 
> > > This patch changes the default to enforcing and adds a configure flag
> > > for distributions to use if they wish to provide a different default
> > > value.
> > 
> > ACK, both the manpage value and the config.h value can be toggled with a
> > configure script.
> > 
> > but I would prefer to push the patch after review of "[PATCHES] Support
> > GPOs referred from other domains" is finished, simply to close the bugs
> > first and then enable the feature for everyone :-)
> 
> CI link: http://sssd-ci.duckdns.org/logs/job/15/05/summary.html

* master: 772464c842968d6e544118ae1aa7c49a7cda2ad6



More information about the sssd-devel mailing list