+ Post New Thread
Page 1 of 3 123 LastLast
Results 1 to 15 of 44
Windows Server 2000/2003 Thread, GPO Bloat in Technical; As we are suffering from very slow logon times the technician and I are working through out GPOs to see ...
  1. #1

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,260
    Thank Post
    965
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164

    GPO Bloat

    As we are suffering from very slow logon times the technician and I are working through out GPOs to see which one(s) are causing the issues.

    We have created a new Test OU with no user or computer based GPOs in place (except from the ones forced on us by the LEA). This got our logon time from over a minute to 7 seconds. We are now adding GPOs back in one by one to see what happens.

    So I have a few questions....

    1. How much time does each GPO add to the logon process? 1 GPO = 1 Second?

    2. What is quicker to process? 15 GPOs each with 1 setting, or 1 GPO with 15 settings?

    3. How do you guys organise your GPOs? One large one per user type (e.g. staff/pupils etc) or several smaller ones?

    There maybe more but not at the moment.

    Cheers everyone,

    Gareth

  2. #2

    AngryTechnician's Avatar
    Join Date
    Oct 2008
    Posts
    3,730
    Thank Post
    698
    Thanked 1,211 Times in 761 Posts
    Rep Power
    394
    I've heard anecdotal evidence that spreading the settings across many OUs increases the time slightly, but I don't think it's the significant factor. More important will be the number of settings, and most importantly, what they are. Some will simply take longer than others.


    Have a look at Fixing Group Policy problems by using log files IIRC the logs are timestamped so you can see which things are taking longer than others.

    I split my GPOs into User and Computer settings whenever possible and tend to only have one per user/computer type. Any settings that are shared across multiple types will go into a general GPO. This is more because I find it easier to manage that way than because of any worries about performance.
    Last edited by AngryTechnician; 21st April 2011 at 10:39 PM.

  3. Thanks to AngryTechnician from:

    garethedmondson (21st April 2011)

  4. #3

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,260
    Thank Post
    965
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    CHeers AT, I am running a program called Group Policy Reporter. I'll read the tech doc and see how it all goes.

    Gareth

  5. #4

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    15,819
    Thank Post
    873
    Thanked 1,675 Times in 1,458 Posts
    Blog Entries
    12
    Rep Power
    444
    I have been told that internet explorer settings can cause logon times to slow right down for some reason. Might be worth trying any GPO's with IE settings in first.

  6. Thanks to FN-GM from:

    garethedmondson (21st April 2011)

  7. #5

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,260
    Thank Post
    965
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    Now that is interesting - we removed one of our IE GPOs and it sped up how quickly IE started on a machine. The only other one we have sets the home page.

    Gareth

  8. #6

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    15,819
    Thank Post
    873
    Thanked 1,675 Times in 1,458 Posts
    Blog Entries
    12
    Rep Power
    444
    Do you have any branding setup in IE? Custom information like "provided my x school"

    If you enable verbose mode you might be able to see whats taking all the time logging on. It should show exactly what is being processed and it may help narrow it down.

  9. 2 Thanks to FN-GM:

    garethedmondson (29th April 2011), laserblazer (22nd April 2011)

  10. #7

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,260
    Thank Post
    965
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    I read about the custom information and that it may slow down logons when doing my research for the issues. Luckily we have none.

    WHen I get back in next week (or the LEA fix my VPN connection) then I shall enable the verbose stuff. I do have a log file from Policy Reporter if anyone fancies a look. It is in Excel format.

    Gareth

  11. #8

    Join Date
    Dec 2008
    Location
    Essex
    Posts
    2,137
    Thank Post
    1
    Thanked 326 Times in 316 Posts
    Rep Power
    77
    @gareth - PM me the file.

    Have you nailed the GPO to one policy, i.e IE GPO?

    Sukh

  12. Thanks to sukh from:

    garethedmondson (29th April 2011)

  13. #9
    IanT's Avatar
    Join Date
    Aug 2008
    Location
    @ the back of my server racks farting.....
    Posts
    1,891
    Thank Post
    2
    Thanked 118 Times in 109 Posts
    Rep Power
    59
    if you run gpresult how many GPO's are loading?

    Its amazing how many GPO's people create for 1 site (school), I think the most I've ever seen is 95 GPO's! when really they needed about 15!

  14. Thanks to IanT from:

    garethedmondson (29th April 2011)

  15. #10

    Join Date
    Apr 2008
    Posts
    853
    Thank Post
    111
    Thanked 112 Times in 108 Posts
    Rep Power
    45
    I dont have 95 but I have quite few grouped i.e. configPowerOptions or installMovieMaker I find its easier to manage and get to the bottom of GPO problems i.e. if I want to give just science staff and no other staff moviemaker I dont need to mess around editing policies I just add that GPO to the science AD tree (I know this is a simple explanation but you get my drift!)

  16. Thanks to irsprint84 from:

    garethedmondson (29th April 2011)

  17. #11

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    15,819
    Thank Post
    873
    Thanked 1,675 Times in 1,458 Posts
    Blog Entries
    12
    Rep Power
    444
    Quote Originally Posted by IanT View Post
    if you run gpresult how many GPO's are loading?

    Its amazing how many GPO's people create for 1 site (school), I think the most I've ever seen is 95 GPO's! when really they needed about 15!
    We have one for every printer. We deploy them by group policy. So we have a large number.

  18. Thanks to FN-GM from:

    garethedmondson (22nd April 2011)

  19. #12


    Join Date
    Mar 2009
    Location
    Leeds
    Posts
    6,573
    Thank Post
    228
    Thanked 851 Times in 730 Posts
    Rep Power
    294
    isnt it supposed to be "best practice" to create a new gpo for ever msi you have so one for paint.net another for flash another for java . . . ? (now granted i dont do this its messy)

    it can help to remove parts of the gpo that arnt in use so if there are no user setting disable them in gpmc. If you dont need media player/ie/wsus settings in a policy remove the adms from it and so on

  20. Thanks to sted from:

    garethedmondson (22nd April 2011)

  21. #13

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,260
    Thank Post
    965
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    Hi Sukh,


    Thanks for offering to take a look at the file. In this first file is the information from the day we run the program for the first time. I have taken earlier days out. For some reason I cannot send a file through a PM so have put it here - open for all to see. I don't think there is anything private in there.


    It is in XL format.


    I look forward to hearing from you.


    Gareth
    Attached Files Attached Files

  22. #14

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,260
    Thank Post
    965
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    This is what we have tended to do over the years. Maybe it's time to look at joining some together.

    Gareth

  23. #15

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,260
    Thank Post
    965
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    Quote Originally Posted by sted View Post
    isnt it supposed to be "best practice" to create a new gpo for ever msi you have so one for paint.net another for flash another for java . . . ? (now granted i dont do this its messy)

    it can help to remove parts of the gpo that arnt in use so if there are no user setting disable them in gpmc. If you dont need media player/ie/wsus settings in a policy remove the adms from it and so on
    We have individual GPOs for earch MSI and whilst some are allocated at top level, others are allocated to department OUs (specialist software, printers etc. We have also turned off user/computer settings depending on what section is being used.

    Gareth

SHARE:
+ Post New Thread
Page 1 of 3 123 LastLast

Similar Threads

  1. GPO - How do you do it?
    By andy_whitlock in forum Windows Server 2008 R2
    Replies: 3
    Last Post: 15th July 2010, 01:48 PM
  2. Replies: 0
    Last Post: 6th July 2010, 08:45 PM
  3. [MS Office - 2007] .docx file size bloat when printing file with multiple pictures.
    By pete in forum Office Software
    Replies: 5
    Last Post: 29th April 2010, 10:03 AM
  4. EZ-GPO
    By pottski in forum Windows
    Replies: 3
    Last Post: 11th December 2008, 08:52 AM
  5. Removing a GPO
    By _Bat_ in forum Windows
    Replies: 12
    Last Post: 3rd May 2007, 04:27 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •