diff --git a/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1 b/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1
index ae91753..b4a523a 100644
--- a/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1
+++ b/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1
@@ -219,9 +219,12 @@ Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAud
 # 3 LINES BELOW DONT WORK NO GPO CALLED "Default Domain Controller Policy"
 
 #DC only
+New-GPO -Name "Default Domain Controller Policy" -comment "Default policy for domain controllers"
 Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString
+$DCOU = (Get-ADOrganizationalUnit -Identity "OU=Domain Controllers,$DomainOU").DistinguishedName
+New-GPLink -Name "Default Domain Controller Policy" -Target $DCOU
 
 $domainid = $DomainInfo.Name