Group Policy: What's the proper way to do this?

[Jamie_Evans]

I currently have 1 group policy object with about 30 different settings inside it and nothing else, is this the proper way of doing this?

 

I've been told I should have 30 different objects each unique to their own group policy rule.

 

Now upon asking 'why?' I wasn't really given a proper answer by my colleague just that it makes things look a lot cleaner and easier to use in case I need to find something.

 

This is a fair point and I understand it but I know my policy settings inside and out and I'm the only network admin at this particular site so it doesn't effect anyone else.

 

The question that's on my mind now is: Does this effect performance? does having GPO with 30 rules inside it perform better than having 30 GPO's with a single rule in each?

 

To put "performance" into perspective I'm just talking about general computer usability and network login times/GPO related network tasks in general etc

Edited June 2, 2014 by Jamie_Evans

[free780]

You could time the computer startup and login and see if it acceptable. The reason for splitting the settings across different gpos is that you may need to exclude certain pcs/users on occassion. This is a bit more difficult with the 1 gpo.

[synaesthesia]

It's quite a personal thing. I like to go half-half. For a setting with a lot of restrictions, of which a school is a great example, one GPO per setting is a bit silly. I group settings as required. Global workstation settings, global internet settings, staff, student, folder redirections, printer mappings.

[sted]

as above its easier to fault find if you have lots of gpo's with a few settings in than one with everything in it as you can just disable all policies on a user/group and reenable them one by one to find the fault. but by the same token if you have lots of small policies they may have contradictory settings in so you look at them and think why is/isnt it doing x my user policy says it should but a class 12 policy stops it from applying to kids in class 12 say. Personally i have a few sensible size ones but the number of settings in each varies wildly somme have 1 or 2 (so say just proxy settings that apply to everyone) some have more for instance my user policies but its all what your hapiest with really there is no right answer although too mahny policies can slow things down a bit so doing 1 policy per setting isnt good

[Michael]

It depends how you look at it -

 

If (like me), you have GPOs which have been tried/tested, it's just a case of creating a new GPO then importing all the relevant settings. Doing this once is easier than doing it 20 times for example.

 

After this, further customisations (per OU), can be made. Generally I have less than 10 GPOs per OU, but I guess that's just my style.

 

I've seen some networks with as many as 50 GPOs linked which I personally found too cluttered. I think a degree of compromise is needed, but only you can make that call.

[zag]

I have GPO's in categories for example:

 

Computer restrictions

Proxy settings

Folder Redirection

Folder Redirection Fixes

 

Each GPO can contain 1 to about 10 different tweaks.

 

I havent seen any perfomance changes in using multiple GPO's, but you could probably test it using GPO modelling.

[sparkeh]

There is no 'right way' to do this, just whats best for you.

 

In terms of performance there are a few things to consider. Group policy works by checking each GPO to check if anything has changed. So if you have one giant GPO and nothing has changed the machine can quickly verify that nothing needs to be done (so this is quick), if you have lots of small GPOs then the machine needs to check each one for changes (which apparently is a slower process). On the flip side, if you have one giant GPO and one thing changes, the machine reapplies the whole GPO (not just the changes - this is how Group Policy works) so this is a slow process, however if you have lots of small GPOs and one thing changes in one GPO then it only has to reapply that one GPO (this is quick).

 

So really its a trade off, if you have fairly static settings then fewer, bigger GPOs is better for performance, if your settings change regularly then more, and smaller GPOs are better.

[themightymrp]

As is mentioned above, there is not hard and fast way to do this. It's all down to personal preferences.

 

I have a multitude of GPO's containing anything from one setting up to about 30! (generic student lockdowns). I think it helps with a good OU structure for where and what to put into your GPO's. Make sure you disable processing of the User Config section for GPO's that only have Computer Config settings for example.

 

With the right layout, even having multiple settings in a GPO, it can still be easy to track a troublesome setting. I make use of the Group Policy Modelling Wizard quite frequently to see which settings are taking precedence.

 

I would imagine that you would at the very least need 2 GPO's though, to cover the differences between staff and students? Unless you have all manner of WMI filters configured?

[edutech4schools]

Does this effect performance? does having GPO with 30 rules inside it perform better than having 30 GPO's with a single rule in each?

 

When the GPO system was first introduced it did have a performance hit doing it one way rather than the other but that is not the case any more.