Group Policy Management

[GRitchie]

Hello,

Is there a 'preferred' way to configure Group Policies?

For example, should you apply them to containers/ou's or should you apply them to security groups with the scope options, then add those users to the security groups?

 

Opinions? :-)

[Michael]

Users should be added to Security Groups, unless you want to add hundreds of users manually to a particular share?

 

Group Policies are linked to OUs. Just imagine it like a tree - the first policy coming from the trunk, then each policy further along the branch.

 

Now if you set a policy to control the wallpaper in the policy near the trunk, then specified a different wallpaper in the policy at the end of the branch, the end of the branch would win.

 

Computer policies always win over user again if there's the same/similar policy you can apply on both.

 

It's generally recommended to apply only a reasonable number of GPOs. In most networks I manage, I typically have 20-30 GPOs. Anything over 50 (depending on the requirements), can get more complicated to manage reasonably, but I appreciate everyone's different

[Steve21]

Think it depends what GPO it is, I mean take drive mappings we have all of ours in 1 GPO, then within the GPO it's filtered by the individual map to security groups. So it's applied top level of our users OU. So that's one GPO, vs 3-4 (e.g. Students/Staff/Admin/SLT)

 

Take something like "configure random admin software" then as it's only to such a few number of people I use the security groups, as means less processing for others etc

 

To me it's make it simple to follow/manage

 

Steve

[Firefox]

Hope this helps

 

1) You can't apply a GPO to a container

2) The most common way to link a GPO is to an OU (can be linked to a subnet but I'd say that was rare)

3) You then look at scoping them to a security group to meet your needs

 

So best practice would be all you mentioned without the containers bit.

 

Make sure you link the GPO to the OU closest to the object your trying to control, that way you won't have to worry as much about inheritance. Where possible use groups to scope all GPO's as this will hopefully prevent you needing to block inheritance (this is some very much best avoided).

 

EDIT: We currently operate with about 200 GPO's in our main domain, so targeting correctly is vitally important.

Edited June 8, 2015 by Firefox

[pete]

I do it by OU, but I may have sub-components of a policy (GPP, for example) based on security groups.

 

Whatever you do, document your work by writing a brief description of what the policy does in the comment that shows on the "Details" tab in GPMC.

 

Add one-line amendments (with initials and datestamp) when you add something new.

 

(Edit policy > Properties > Comment tab)

 

Or I fill your hovercraft with eels, your choice.

Edited June 8, 2015 by pete

[mikkydoos]

I separate mine out for simplicity.

 

-> Internet settings

-> Folder redirection

-> User Security

-> Printers install

-> Drive maps

 

etc etc etc

[psydii]

The answer is: if you have a well managed RBACg environment then manage entirely through group membership.

 

Most of us primarily filter by OU. Sometimes using groups and loopback and gpp filtering to give a little more flexibility.