Group Policies - How do you do yours?

[craigcamacho]

Guys,

 

When creating new group policies do you guys shove all your policies in a single GPO with a generic name i.e. "Student Policy" or do you break them down and each new policy has its own GPO named something sensible like "Student - Restrict Control Panel"? My preference is the latter but I was talking with somebody the other day who says the best way is to put them all into the same policy as its more manageable.

[tmcd35]

Polices are assigned at the lowest common OU level required, we have a deep OU structure splitting user and computer OUs and, in each, splitting by teaching/non-teaching, rooms, years, etc.

 

Each OU may have up to four GPO's gouping similar policies - Desktop, Security, Internet, Printers

[MatthewL]

We used to have a Default User, Default Computer, then sub ones for different departments and then others that were filtered on a user basis.

[jertsy]

I pretty much do what tmcd35 does, I group the GPO's per function, staff IE, student IE, student lockdown, staff lockdown etc... and link them to the OU's that the staff or pupils reside in.

I like this approach as it allows me to be more granular by allowing more access for staff than pupils. There are many different ways to do it but I would say keep it simple.

[MatthewL]

I was always advised keep it as few polices as possible to prevent issues especially if working on remote sites. Not too bad if on one site.

 

Wish I still was at my own place could of screen grabbed it would be easier to explain ours.

[AdamzB]

Global Machine GPO

Global Teaching Staff

Global Admin Staff

Global KS2 Pupil

Global KS3 Pupil

 

Then use security group base filtering as required.

[sparkeh]

I set policies at the lowest level that captures all the intended targets. Each policy has settings related to the same theme.

 

For example I have a drive mapping gpo, all devices need drive mappings so this goes at the top of the machines OU.

However, the admin staff settings gpo sits half way down the users structure at the Admin Users OU.

 

I think this gives a good balance between flexibility and manageability.

[Sagima]

We have separate ones for staff, students, desktops and laptops. When we implement a new gp it goes into its own gpo and then gets merged into the main one during the summer.

Some department OUs have their own little gpo for something specific to that room