Number of Group Policy Objects

[bmittleider]

I am still a little new to Windows Server and Group Policy Objects. I am curious if there is a limit of how many Group Policy Objects should be used? I am trying to construct multiple GPOs to be applied based on user/computer group membership. I would like to create a Global GPO that handles the basics that are applied to all our users/computers but then I would like to have a separate GPO for students and faculty as they have different restrictions that extend the global GPO. I would also like to have a GPO that handles things like my printer mappings and drive mappings.

 

With all that said I'll ask the question again. What is the limit for GPOs?

[featured_spectre]

I have a general PC GPO's, along with individual yer group GPO's and varying leeks of staff GPO's. EG admin staff get near admin level fo stuff like SIMs and FMS to work, but teachers are marginally aboe year 8 pupils in their restrictions. It's a case of how locked down you want them to be!

[bio]

There is a limit of 999 Group Policy objects (GPOs) that you can apply to a user account or computer account. This does not mean that the total number of policy settings on the system is limited to 999. Rather, a single user or computer will not be able to process more than 999 GPOs. This limit exists for performance reasons.

 

Active Directory Maximum Limits Scalability Capacity

 

bio...

[bmittleider]

Okay, well I don't have anywhere near 999 but I wasn't sure if 10-15 different GPOs were bad. I have only 1-4 applying to the specific groups/OUs. Thanks.

[macdaddy]

Okay, well I don't have anywhere near 999 but I wasn't sure if 10-15 different GPOs were bad. I have only 1-4 applying to the specific groups/OUs. Thanks.

 

You also may want to look into WMI Filter. I use it to apply with different OS's. Since we are running XP/7/2008 TS/2008 R2 TS the student policies are all slightly different. By using WMI Filter I have multiple policies but one OU.

[powdarrmonkey]

Regardless of actual limit, every applied GPO incurs some overhead, and on low-power machines it becomes noticeable at about seven or eight objects IME, so combining them where you can is wise. You need to find a balance between administrative flexibility and overhead.

[sted]

Regardless of actual limit, every applied GPO incurs some overhead, and on low-power machines it becomes noticeable at about seven or eight objects IME, so combining them where you can is wise. You need to find a balance between administrative flexibility and overhead.

 

its also worth disabling the user part if its a pc policy or pc part if its a user policy and dumping non needed admin templates. for instance i have a specific gpo for wsus (well 2-3 servers/workstation/staff laptops) so the general curriculum pcs policy dosent need the admin template wor windows update and dosent need any user settings which helps speed up proscessing