From 03e96662cc73925e2d5c4bf2794c75885c4fd4e6 Mon Sep 17 00:00:00 2001
From: Jan-Bulthuis <git@bulthuis.dev>
Date: Mon, 9 Jun 2025 02:57:06 +0200
Subject: [PATCH] Set ad_gpo_implicit_deny to true

---
 modules/nixos/domain.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/domain.nix b/modules/nixos/domain.nix
index 696e487..609433c 100644
--- a/modules/nixos/domain.nix
+++ b/modules/nixos/domain.nix
@@ -97,6 +97,7 @@ in
         ldap_schema = ad
         ldap_id_mapping = true
         ad_gpo_access_control = enforcing
+        ad_gpo_implicit_deny = true
         dyndns_update = true
         dyndns_refresh_interval = 3600
         dyndns_update_ptr = true