Group Policy - Number of GPOs

[mdrabble]

Looking though my GPO and wondering how I can steamline how settings are applied.

 

At present I have several smaller GPOs which makes it easier for testing and also gives me some flexibility regarding deployment.

 

But I wondered - am I better keeping several smaller GPOs (eg. Folder Redirections, Separate Drive Mappings, User Settings, etc) or am I better combining them in to less - larger GPOs

 

I can see the benefits in both but never really looking into which is the best method and wondered how other people have their GPO settings.

[Liam]

This has been covered in here quite a bit I think. I remember looking at something recently.

I have also gone for a less is more approach. I keep everything named so that it's easy to identify- but generally most settings are just applied to pupils or staff. I generally seperate things like office settings or internet settings.

From experience there is no real time saver by having less though just looks more manageable

[Michael]

If you need to link a setting in several places within your structure, then create it its own GPO and link it where required.

[psydii]

http://www.edugeek.net/forums/windows-server-2008-r2/185285-ad-gpo-cleanup.html

 

Generally put settings as high up the OU structure as possible. If there is one OU / Group where a 'universal'/domain wide setting is not required, or needs to be different, create an GPO at that level to change the 'universal'/domain wide setting.

 

We filter by OU and group and use loopback to accommodate various device/user classes and use cases.

 

Avoid WMI filtering at all cost for performance reasons. (1 WMI filter will undo all savings from consolidating GPOs)

[Rob_D]

I prefer different policy objects for different types of settings (as you said, folder redirects, app installs, printer management... stuff like that). I find it makes it easier if I need to change or move a policy, and to see what's going where. Also there are some that have been broken up because I need some policies to apply before others.

[jthompson]

I go along the route of a larger number of smaller GPOs. It means that you know exactly where to go to configure something, old unneeded settings are less likely to hang around unnoticed and you're not likely to break unrelated things when making adjustments. Also, by looking in the Windows event logs, if something in Group Policy is taking a long time to process, you'll have a better idea of what it is.

 

Things like settings for Windows Updates, SOLUS, web proxies, Drive maps, individual software packages, etc, get separated out and linked to the relevant OUs. This means that whilst we might have high number of GPOs overall, the number actually applied to any particular user/computer won't be anything like that number, and the need for filtered targeting is kept to a minimum. Here on my computer, I have about 30 or so computer policies (the majority are app deployments) and 6 user policies. The majority of these policies will only have a few settings in them.

[mdrabble]

Cheers for the replies - Always good to have a sanity check now and then.

[sparkeh]

There's no right answer on this really. Static gpos with no changes load quickly but a gpo with changes reapplies every setting, not just the changes. Therefore a change to a large gpo takes a long time to apply. Also it takes a longer to process a large number of gpos to check for changes than a small number of gpos. It a balancing act.

 

I tend to put settings I know won't change into large gpos and things that might change into small gpos (so that reapplying doesn't take too long)

Edited July 19, 2017 by sparkeh