AD and GPO Cleanup

[Theldron]

Hi all,

 

Just wondering if anyone has or can advise me on the advised process for cleaning up Active Directory and Group Policies?

 

I setup the network in 2012, but had only used CC3 before that so did not know anything about setting up AD or GPOs. Our sponsor at the time had hired a company that were supposed to put in the servers and work with me to setup AD, GPOs, etc. But the guy I was supposed to be working with, brought in the servers, then went on holiday for 2 weeks and I only had 3 weeks to get everything setup on my own.

 

I patched together the network from youtube vids and guides found through google, so I know it could all be setup alot better now that I have more knowledge.

 

Cheers

[Fazza]

I did this a few years ago with the aim at speeding up our login times on the student computers.

 

I basically exported (and then printed out) all the associated group policies and went through them with a highlighter pen and marking them with appropriate titles such as 'Security' 'Internet' 'Annoyances' 'General'

 

Over the years a lot of settings had either been duplicated or added that contradicted a previous setting that hadn't been seen as it was in a group policy that was named nothing to do with the setting!

 

I then created new group policies with a proper naming convention that had a title that related to what is in the GPO making it easier to manage going forward. For example instead of a single GPO simple called 'Student Settings' we now have a few called 'Student - Internet Setting' 'Student - Lockdown' 'Student - Annoyances' etc.

 

You shouldnt have 1 single Group Policy but neither should you have dozens that only contain one setting - you need to get the balance right else your logon times can increase.

[kennysarmy]

I have a prefix for all group policies along with decent naming conventions.

 

The prefixes are C - applied to computers, U - applied to Users and SD - software distribution policy.

 

Every little helps.

[ADMaster]

I read a while back that you should separate policies by type i.e. admin templates vs gpp preferences. This doesn't always work out in practice.

Here are a few of mine

Applocker

admin templates all

gpp computers

gpp users

staff desktop settings

student desktop settings

folder redirection

several specific lockdown user settings for testing / training accounts.

a few specific gpos for servers

 

For the active directory side setup a good OU structure.

Staff > building / function

Students > Building > year

Student computers > building > room

staff computers > building

servers > special functions RDS / Hyper-v

 

This will allow you to apply GPOs to the right group of users or computers and aid in cleanup. I have an OU

staff > outgoing > year

everyone leaving this year gets moved her so I can disable accounts 1st September.

I can do the same with the leaving students because they are in OUs by year.

 

Get a good naming convention for your computers so you know where they are and put them in the correct OU. I use a 2 letter building code so High School =HS then room number then PC number

HS-rm100-01 HS-rm100-02 etc etc.

There are dsquery, powershell and other tools that will let you create a report of computers and sort by last log on. This will help you clean up the computer accounts.

[XiJ]

I'll often have targeted gpp's these days so internet settings would be for all users - but targeted to groups - staff, pupils, admin etc.

 

I am sometimes guilty on having gpo's ghat only have one function. But they are more 'legacy' these days as I try to tidy them up.

 

I agree that a balance between not having too many but not being too generic is best

[joelbarlow40]

You could take a look at following articles:

 

https://gallery.technet.microsoft.com/scriptcenter/Group-Policy-cleanup-c8b2bbea

 

https://community.spiceworks.com/scripts/show/1875-ad-cleanup

Alternatively, you may also try the below automated solutions to clean Active Directory and Group Policy

 

https://www.lepide.com/lepideauditor/active-directory-cleanup.html

 

https://sdmsoftware.com/group-policy-blog/group-policy-cleanup/new-options-group-policy-cleanup-gpo-exporter/

[Theldron]

Thanks guys, going through tidying up now. Big request, call me cheeky I can take it, but if not too much trouble could someone send me their student lockdown GPOs for their workstations? I have started doing it (prohibiting control panel etc) but would like a template to work from so that I can pick, choose and test. This is for Windows 7 and server 2008 r2 - though do have server 2012 as well.

 

Cheers

Edited June 17, 2017 by Theldron

[psydii]

Controversial opinion: don't bother locking down the student desktop experience. as long as they don't get admin and your network shares have decent ntfs acls there really isn't much need. Pretty much the only things I have locked down are those settings that lock for the end user if the admin sets them (e.g trusted sites etc).

 

(Do use AppLocker though to prevent unauthorised executables)

 

Obviously they don't get admin.

 

 

As for consolidating gpos (or even initial design work) @Fazza's low tech method is one I have used on several occasions with great success.

[TechMonkey]

I was always told, computer OR user and then disable the section not being used.

 

I generally apply GPOs by OU, so have a default User GPO and then one for students and one for staff in their respective OU. Then ones to adjust any special permissions if needed.

 

Not heard GPP or GP but not together before.

[MatthewL]

I generally work with these for starters for example:

 

Default Computer

Default User

Default Server

User - Staff

User - Student

User - IT

Server - depending if it needs other settings i.e. RDS farm.

Test User

Test Computer

 

Also if its just doing computer or user settings I change the enable/disable appropriate to it.

[Theldron]

Hi guys,

 

Thanks for all the advice.

 

Couple more questions:

 

1: Do you put software installs via GP in one GPO or seperate for each piece of software.

2: What do you use for profiles? I currently use roaming profiles with profile redirection, but was thinking of just using folder redirection and not entering anything in Profile Path in AD, though a the moment this is causing a "The User Profile Service failed the logon” error message.

 

Cheers again

[TwistedHelixis]

In the past I have used AD tidy to help with AD - Cjwdev | AD Tidy

 

The also do some other handy little tools

[angrycomputingteacher]

Hi guys,

 

Thanks for all the advice.

 

Couple more questions:

 

1: Do you put software installs via GP in one GPO or seperate for each piece of software.

2: What do you use for profiles? I currently use roaming profiles with profile redirection, but was thinking of just using folder redirection and not entering anything in Profile Path in AD, though a the moment this is causing a "The User Profile Service failed the logon” error message.

 

Cheers again

 

1. We have 1 GPO to deploy software through.

2. Were running students and staff with local profiles and folder redirection and it's fine.

[Theldron]

1. We have 1 GPO to deploy software through.

2. Were running students and staff with local profiles and folder redirection and it's fine.

 

Hi Mate,

 

Did you have to set anything in GPO to get local profiles to work?

If I remove the profile path from AD I keep getting the error above, and if I allow temporary profiles of course it logs in but none of the redirected folders work - Ahhhhhhhh

 

Cheers

 

* Fixed it, my brains broken. I blame Friday.

Edited June 23, 2017 by Theldron

[kuingul]

Here's a PowerShell script that should help with AD cleanup: Cleanup Active Directory with PowerShell