GPO Advice

[tommccann]

Hi guys, im setting up my first server from scratch and as im fairly new to administration i was after some advice. what policies do you set for users?? iv set the particular ones i want but its likely iv missed some. so to the point... what do you set for users?

 

Thanks for your help

[bio]

This surely is a tough question. This depends on what you want to achieve here. This best way to learn GPO and their behavior is by testing, testing and testing.

I would setup a lab (vmware or something) and just play around with the various settings. You could start out with login/logout sripts and folder redirection, changing some settings on the desktop or internet explorer. Also check this :

 

Learning about GPO's - KWSupport

 

bio..

[tommccann]

all done, thanks. i just plowed through every policy possible and got exactly what i wanted. working very well now, thanks!!

[joshd]

Hi Tommccann

 

I dont know your level of experience with Group Policy but heres the best advice I can give...

 

A good rule of thumb with Group Policy is to make separate policies for each task you are trying to accomplish, rather than sticking everything in one big policy. Also, try not to edit the default group policy objects, leave them alone and create your own.

 

For example, when you want to set up redirected folders, stick all the related config in one GPO, when you want to setup desktop restrictions, stick all of thant in its own GPO. Deploying browser settings? stick that in its own GPO. It makes it much much easier when you are having problems and need to debug your config. It also makes it easier for the next admin to see how your server is setup when you leave or something.

 

Also, get to grips with the debugging tools, RSOP is a great tool and should always be your first port of call when trying to work out why a GP setting isnt working.

 

Hope this is useful!

[SYNACK]

all done, thanks. i just plowed through every policy possible and got exactly what i wanted. working very well now, thanks!!

 

This is exactly what I do, you can't underestimate the value of having read through the lot and knowing what is avalible.

 

An addition to the above advice, be careful not to use too many seporate policies as the more you have the more seporate passes must be run to configure each session and the longer it takes to logon. Multiple policies also increase bandwidth usage as they must be downloaded each time. It is a good idea to never mess with the default domain policy and to seporate out major roles like student policy, staff policy etc but don't get too fine grained or your policy processing time will get mental.