GPO Bloat

As we are suffering from very slow logon times the technician and I are working through out GPOs to see which one(s) are causing the issues.

We have created a new Test OU with no user or computer based GPOs in place (except from the ones forced on us by the LEA). This got our logon time from over a minute to 7 seconds. We are now adding GPOs back in one by one to see what happens.

So I have a few questions....

1. How much time does each GPO add to the logon process? 1 GPO = 1 Second?

2. What is quicker to process? 15 GPOs each with 1 setting, or 1 GPO with 15 settings?

3. How do you guys organise your GPOs? One large one per user type (e.g. staff/pupils etc) or several smaller ones?

There maybe more but not at the moment.

Cheers everyone,

Gareth

I've heard anecdotal evidence that spreading the settings across many OUs increases the time slightly, but I don't think it's the significant factor. More important will be the number of settings, and most importantly, what they are. Some will simply take longer than others.


Have a look at Fixing Group Policy problems by using log files IIRC the logs are timestamped so you can see which things are taking longer than others.

I split my GPOs into User and Computer settings whenever possible and tend to only have one per user/computer type. Any settings that are shared across multiple types will go into a general GPO. This is more because I find it easier to manage that way than because of any worries about performance.

CHeers AT, I am running a program called Group Policy Reporter. I'll read the tech doc and see how it all goes.

Gareth

I have been told that internet explorer settings can cause logon times to slow right down for some reason. Might be worth trying any GPO's with IE settings in first.

Now that is interesting - we removed one of our IE GPOs and it sped up how quickly IE started on a machine. The only other one we have sets the home page.

Gareth

Do you have any branding setup in IE? Custom information like "provided my x school"

If you enable verbose mode you might be able to see whats taking all the time logging on. It should show exactly what is being processed and it may help narrow it down.

I read about the custom information and that it may slow down logons when doing my research for the issues. Luckily we have none.

WHen I get back in next week (or the LEA fix my VPN connection) then I shall enable the verbose stuff. I do have a log file from Policy Reporter if anyone fancies a look. It is in Excel format.

Gareth

@gareth - PM me the file.

Have you nailed the GPO to one policy, i.e IE GPO?

Sukh

if you run gpresult how many GPO's are loading?

Its amazing how many GPO's people create for 1 site (school), I think the most I've ever seen is 95 GPO's! when really they needed about 15!

I dont have 95 but I have quite few grouped i.e. configPowerOptions or installMovieMaker I find its easier to manage and get to the bottom of GPO problems i.e. if I want to give just science staff and no other staff moviemaker I dont need to mess around editing policies I just add that GPO to the science AD tree (I know this is a simple explanation but you get my drift!)

Quote:

---

Originally Posted by IanT

if you run gpresult how many GPO's are loading?

Its amazing how many GPO's people create for 1 site (school), I think the most I've ever seen is 95 GPO's! when really they needed about 15!

---

We have one for every printer. We deploy them by group policy. So we have a large number.

isnt it supposed to be "best practice" to create a new gpo for ever msi you have so one for paint.net another for flash another for java . . . ? (now granted i dont do this its messy)

it can help to remove parts of the gpo that arnt in use so if there are no user setting disable them in gpmc. If you dont need media player/ie/wsus settings in a policy remove the adms from it and so on

Hi Sukh,


Thanks for offering to take a look at the file. In this first file is the information from the day we run the program for the first time. I have taken earlier days out. For some reason I cannot send a file through a PM so have put it here - open for all to see. I don't think there is anything private in there.


It is in XL format.


I look forward to hearing from you.


Gareth

This is what we have tended to do over the years. Maybe it's time to look at joining some together.

Gareth

Quote:

---

Originally Posted by sted

isnt it supposed to be "best practice" to create a new gpo for ever msi you have so one for paint.net another for flash another for java . . . ? (now granted i dont do this its messy)

it can help to remove parts of the gpo that arnt in use so if there are no user setting disable them in gpmc. If you dont need media player/ie/wsus settings in a policy remove the adms from it and so on

---

We have individual GPOs for earch MSI and whilst some are allocated at top level, others are allocated to department OUs (specialist software, printers etc. We have also turned off user/computer settings depending on what section is being used.

Gareth