Preferences for Preferences

[PiqueABoo]

I could:

 

a) Scatter lots of GPOs around an OU hierachy each with specific sets of Preferences relevant to a given OU branch.

 

b) Just have one or two near the top of the hierarchy, with settings for everything way down below but using conditional targeting e.g. set A if user/computer belongs to OU X, set B if user/computer belongs to OU Y.

 

[..or "belongs to group X"]

 

Anyone deeply enough into this yet to have strong opinions about the best way to go?

[SYNACK]

The more conditionals you have the more load gets put on to each machine as the conditionals are assessed each time there is a policy refresh on every single station that the policy is applied to (WMI filtering of policies).

 

You also want to minimise the layering of GPOs as the more you apply even if it is only for one or two settings will increase your load time on the station.

 

The best balance is having few policies that are allocated via different OUs and only minimal WMI filtering if required, ie for users when using XP and Vista clients.

[PiqueABoo]

The more conditionals you have the more load gets put on to each machine

 

Uh huh... but what's that load like for 2K8 preferences in RL? I can make any conditional depend on a bunch of variables it's already injected into the environment i.e. rounding up all that information at the "start of time" is a routine hit regardless. Don't know, but given that there's a good chance it also rounded up values for all the built-in targeting options e.g. if some setting of mine depends on the computer's OU, it likely already has the value of that stashed away for what should be a very fast compare. I can't see how **per setting** filtering could possibly work otherwise.

 

[That said, if pre-defined options don't cut it you can use custom WMI filters in targeting rules - something I'm planning to avoid]

[SYNACK]

Ah, I had misunderstood the section of GPO that you were talking about. The preferences policy will be smaller to download and probably easier to find problems with if split into smaller units and applied at the OU level. The conditionals in that section are only assessed at logon so it depends on how complex the settings and variables are as to whether this will create a noticible extra delay on slow computers or slow links. The WMI filtering that I was thinking of is assessed and runs the full WMI query every time there is a background or foreground policy refresh hence the confusion.

 

If you have lots of wireless laptops or optimise your profiles for quick logons then you would probably want the seporated out prefs but in the end it comes down to personal preference.

[PiqueABoo]

Just accidently hit this little article from Darren M-E (gpoguy) which is a good and fairly succint round up of the various GPO performance factors:

 

Group Policy: Optimizing Group Policy Performance