GPO design

[sparkeh]

I am just setting up a school to install software via GPO and wondered how other people design their GPOs.

Is it better to have a single GPO per software title or a GPO per OU that contains all the software that needs to be installed to that group of machines?

If GPO processing effects startup and login time is it better to have a lot of GPOs to process or a few large one - or does it even matter?

Cheers

[Gatt]

GPO for Desktop Software - linked to Computers\Desktop OU
GPO for Server only software - linked to Computers\Server OU
GPO for Global Software - linked to a Computers OU

This ensures that any software we dont want o our servers doesnt get deployed to them - eg Auto Power off stuff!

[powdarrmonkey]

I mix tactics depending on scope. If it's only going to be applied to one OU, it goes into a shared GPO to minimise GPO population and keep processing shorter. But if it's going to be shared across OUs, it gets a GPO of its own to make administration easier (the tradeoff of processing time is worth it).

[sparkeh]

So the way I have setup AD is to reflect the structure of the school as each year group has different software to install and separate machines that have whiteboards:

AD
-classroom machines
--Year1
---IWB machine
---non IWB machines
--Year2
---IWB machine
---non IWB machines
-suite machines
etc

but of course there is cross over in software but that can deployed.
I guess a mixture is a way to go then to optimise thing.

[Richie1972]

I tend to have GPO software deployment split into departments, classroom machines, whiteboard machines, office machines, etc.
Far easier to manage.
Not applying any to the servers at the moment, though

[jcollings]

We have an OU set up for each room of computers and each OU has it's own software deployment policy which contains all the software for that room.

[sparkeh]

So for classroom machines, I am thinking of putting a gpo at each level (ie one for classroom machines OU, one for year group and one each for IWB and non IWB) to control granularity of software deployment - that way machines will have at most 3 gpos to process.

I guess that isn't going to effect things too much.

[powdarrmonkey]

So for classroom machines, I am thinking of putting a gpo at each level (ie one for classroom machines OU, one for year group and one each for IWB and non IWB) to control granularity of software deployment - that way machines will have at most 3 gpos to process.

I guess that isn't going to effect things too much.

Remember that a client still has to evaluate every policy object in the domain to decide whether it applies or not...

[plexer]

If you only have 1 gpo that installs software what do you do if you need to remove a piece of software?

Ben

[powdarrmonkey]

If you only have 1 gpo that installs software what do you do if you need to remove a piece of software?

Ben

Er... remove it from the policy? Maybe I'm missing something here...

[penfold]

Computers split into Department OU's with software deployed within that.

[sparkeh]

Remember that a client still has to evaluate every policy object in the domain to decide whether it applies or not...

Oh, don't they just evaluate the policies of the OU they are in and the OU above?

If you only have 1 gpo that installs software what do you do if you need to remove a piece of software?
Ben

As PM says, if you remove a piece of software from a gpo the machines uninstall it.

[plexer]

Does that remove the software from the clients though?

Ben

[powdarrmonkey]

Oh, don't they just evaluate the policies of the OU they are in and the OU above?

Well, somewhere along the line the client has to find out what objects are applied to the OU it's in, and that means evaluating them all. I believe it's done client-side, but I'll be stuffed if I can find my notes on it (might have thrown them away) so don't quote me on it.

Does that remove the software from the clients though?

When you remove the package from the GPO you're asked whether you want to leave the existing installations in place or remove them immediately.

[Psymon]

2 choices when removing software along lines of

Remove immediately (poreventing more usage)
Remove from GPO but not from machines (allowing continued use)

Simon