Nope. In pre-Server 2008 networks there is no way for subsets of domain user accounts to have different account policies, unless you look to 3rd party products like SpecOps Password Policy. Darren From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Jerry Williams Sent: Thursday, October 02, 2008 8:28 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Default Domain Policy and Account Lockout I have Windows 2003 AD and have the account lockout threshold set on the Default Domain Policy. I have an account in an OU that I would like to NEVER get locked out. Is there any way to make the Default Domain Policy not effect this user? I have tried to enable the block policy inheritance option, but that seems to have no effect. Any ideas?