GPO design

[sparkeh]

I am just setting up a school to install software via GPO and wondered how other people design their GPOs.

 

Is it better to have a single GPO per software title or a GPO per OU that contains all the software that needs to be installed to that group of machines?

 

If GPO processing effects startup and login time is it better to have a lot of GPOs to process or a few large one - or does it even matter?

 

Cheers

[Gatt]

GPO for Desktop Software - linked to Computers\Desktop OU

GPO for Server only software - linked to Computers\Server OU

GPO for Global Software - linked to a Computers OU

 

This ensures that any software we dont want o our servers doesnt get deployed to them - eg Auto Power off stuff!

[powdarrmonkey]

I mix tactics depending on scope. If it's only going to be applied to one OU, it goes into a shared GPO to minimise GPO population and keep processing shorter. But if it's going to be shared across OUs, it gets a GPO of its own to make administration easier (the tradeoff of processing time is worth it).

[sparkeh]

So the way I have setup AD is to reflect the structure of the school as each year group has different software to install and separate machines that have whiteboards:

 

AD

-classroom machines

--Year1

---IWB machine

---non IWB machines

--Year2

---IWB machine

---non IWB machines

-suite machines

etc

 

but of course there is cross over in software but that can deployed.

I guess a mixture is a way to go then to optimise thing.

[Richie1972]

I tend to have GPO software deployment split into departments, classroom machines, whiteboard machines, office machines, etc.

Far easier to manage.

Not applying any to the servers at the moment, though

[jcollings]

We have an OU set up for each room of computers and each OU has it's own software deployment policy which contains all the software for that room.

[sparkeh]

So for classroom machines, I am thinking of putting a gpo at each level (ie one for classroom machines OU, one for year group and one each for IWB and non IWB) to control granularity of software deployment - that way machines will have at most 3 gpos to process.

 

I guess that isn't going to effect things too much.

[powdarrmonkey]

So for classroom machines, I am thinking of putting a gpo at each level (ie one for classroom machines OU, one for year group and one each for IWB and non IWB) to control granularity of software deployment - that way machines will have at most 3 gpos to process.

 

I guess that isn't going to effect things too much.

 

Remember that a client still has to evaluate every policy object in the domain to decide whether it applies or not...

[plexer]

If you only have 1 gpo that installs software what do you do if you need to remove a piece of software?

 

Ben

[powdarrmonkey]

If you only have 1 gpo that installs software what do you do if you need to remove a piece of software?

 

Ben

 

Er... remove it from the policy? Maybe I'm missing something here...

[penfold]

Computers split into Department OU's with software deployed within that.

[sparkeh]

Remember that a client still has to evaluate every policy object in the domain to decide whether it applies or not...

 

Oh, don't they just evaluate the policies of the OU they are in and the OU above?

 

If you only have 1 gpo that installs software what do you do if you need to remove a piece of software?

Ben

As PM says, if you remove a piece of software from a gpo the machines uninstall it.

[plexer]

Does that remove the software from the clients though?

 

Ben

[powdarrmonkey]

Oh, don't they just evaluate the policies of the OU they are in and the OU above?

 

Well, somewhere along the line the client has to find out what objects are applied to the OU it's in, and that means evaluating them all. I believe it's done client-side, but I'll be stuffed if I can find my notes on it (might have thrown them away) so don't quote me on it.

 

Does that remove the software from the clients though?

 

When you remove the package from the GPO you're asked whether you want to leave the existing installations in place or remove them immediately.

[Psymon]

2 choices when removing software along lines of

 

Remove immediately (poreventing more usage)

Remove from GPO but not from machines (allowing continued use)

 

Simon

[tmcd35]

Does that remove the software from the clients though?

 

Ben

 

Depends on the option you choose when you remove the software from the GPO. You can leave existing install, but stop the software from installing on any new machines. Or you can remove all existing installs of the software immediately (well next reboot).

 

 

I'm currently working on a GPO structure here, ready for the summer. Heres my Current thoughts

 

OUR DOMAIN -

++ All Computers - All Comp Software GPO, All Comp Policys GPO

++++ Staff Comp - All Staff Software GPO, All Staff Policys GPO

++++++ Admin Comp - Admin Only Software GPO, Admin Only Policys GPO

++++++ Teach Comp - Teachers Only Software GPO, Teachers Only Policys GPO

++++ Student Comp - All Curric Software GPO, All Curric Policy GPO

++++++ ICT Comp - ICT Only software GPO, ICT Only Policy

 

ect, etc.

 

So software only gets installed onto computers it needs to be installed on. Software install policys are kept separate from policy settings. I find this the most flexible system.

[sparkeh]

Well, somewhere along the line the client has to find out what objects are applied to the OU it's in, and that means evaluating them all. I believe it's done client-side, but I'll be stuffed if I can find my notes on it (might have thrown them away) so don't quote me on it.

 

Ah right thanks for alerting me, I'll looking into this more.

 

However I guess its just a case of going, "am I in this OU? No - Am in this OU? Yes -> processes GPO"

Wouldnt add to much overhead would it? I still have a small number of OUs.

Edited April 29, 2009 by sparkeh

[powdarrmonkey]

Ah right thanks for alerting me, I'll looking into this more.

 

However I guess its just a case of going, "am I in this OU? No - Am in this OU? Yes -> processes GPO"

Wouldnt add to much overhead would it? I still have a small number of OUs.

 

Finding out which OU you're in is a one-time check, but then each policy object has to be evaluated to find out whether or not it applies to that OU. This is the costly part, but as for numbers I have none. I've never had time nor inclination to actually generate lots of GPOs and measure the results, but at one time the official MS advice was that it made a difference.

[sjl]

###|--------

###|##########|---

###|

###|--------

##############|

##############|------

##############|

##############|------------------------

####################################|

####################################|-----

##############################################|

##############################################|----

 

 

That is a bit of ours we also use WMI filters and Security filters to filter who gets the GPO applied.

Edited April 29, 2009 by sjl