GPOs One or Many

[bladedanny]

Just quick question.

 

Is is better to have many GPOs doing specific things eg 1 for IE settings, 1 for Printer Deployment, 1 for security settings etc per OU or is it better to have one GPO per OU that does everything?

 

Ta,

[riffleman]

I've always subscribed to the idea of creating GPOs for specific tasks. It makes the management of their settings easier if you know which GPO to alter. It also makes it easier to disable specific settings in that GPO by disabling that particular GPO rather than going in and altering the settings individually.

 

A couple of things to remember when applying GPOs is the order in which they are applied and that it's not the number of GPOs applied, but the number of settings that control login or startup times.

[SYNACK]

The more you have the longer it takes to process them, however the more you change them and the more settings they have in them, the more likely it is that they corrupt. This unfourtunatly is far more common under 2008 than it was under 2003. I think that the best practice is somewhere in the middle between one and many.

[6Foot2]

We have multiple GPOs. However each GPO is targeted to a particular task [as far as possible] eg: Office 2010, Internet Explorer, Student Station Lockdown,...

 

If there is a setting that is required that does not seem to fit into the pre-existing GPOs then we will create a new GPO.

 

HTH.

[riffleman]

The more you have the longer it takes to process them.

 

Testing has shown that for it to have any appreciable effect, you need to be applying hundreds of GPOs. In real terms, very few of us will ever notice.

[featured_spectre]

I usually have around 15-20 GPOs per ou, depending on what's needed...the vast majority are computer ou's that apply to most groups.

[localzuk]

Having just deleted 500 GPOs on our system, leaving 120ish in use still, I will have to say - fewer is better...

[bladedanny]

Thanks all,

 

On the network I've inherited it's a mixture of both, some OUs have one far all and some OUs have many doing little things. Basically it's a bit of a mess so I'm going to be starting from scratch with 2008r2 and think I'll go down the Many route.

 

Thanks again,

[ricki]

HI

 

I would say a gpo for each thing

 

eg student lock down one policy

deploy spftware one policy per program

lock down windows 7 computers one policy.

 

Design your ou's structure so that it matches the needs of your organisation. Make it simple and name ou's and the policies so if you are sick or leave another tech knows how things work. Have a naming structure for staff and student accounts plus computers and stick to it.

 

Richard

[Hightower]

We use a GPO for each thing (1 for staff users, 1 for students, 1 for workstations, 1 for each printers, 1 for each software etc) and makes management nice and easy. Now if we need to add a printer or some software it takes a quick click or two to link the related GPO.

[ToyHeartsFan]

Domain GPO for some global settings but then everything else has its own appropriately named GPO.

 

Assigned Application – xxxx, Desktop – xxxx, Security – xxxxx, Internet Explorer – xxxx, Firewall – xxxx, etc…

 

This way it’s a lot easier for you (and anyone else in the future) to see what GPO’s are in place and to manage the settings.

 

 

I would strongly recommend editing each of your GPO’s to reduce logon time this made a noticeable difference for us:

 

GPO Status – If a GPO only has User or Computer settings and not both then disable the one not in use.

 

Add / Remove templates – Remove any administrative templates from a GPO that are not in use.

[kennysarmy]

Domain GPO for some global settings but then everything else has its own appropriately named GPO.

 

Assigned Application – xxxx, Desktop – xxxx, Security – xxxxx, Internet Explorer – xxxx, Firewall – xxxx, etc…

 

This way it’s a lot easier for you (and anyone else in the future) to see what GPO’s are in place and to manage the settings.

 

 

I would strongly recommend editing each of your GPO’s to reduce logon time this made a noticeable difference for us:

 

GPO Status – If a GPO only has User or Computer settings and not both then disable the one not in use.

 

Add / Remove templates – Remove any administrative templates from a GPO that are not in use.

 

We are trying to speed up our logon processing and was recently advises to reduce the number of GPO's even though I don't think we have that many.

On the Computer side we have around 16 - but only 10 apply after WMI filtering for the OS:

And on the User side we have around 22 - but only 11 apply after WMI filtering for the OS:

 

I've just been through every GPO and deleted all the old ones and also disabled either USER or COMPUTER part.

 

I do have a couple of questions though:

 

1. You state editing each of your GPO's to reduce logon time ! - what do you mean by this? I'm only applying (hopefully) settings which are required - so would rather not take them out !

2. Add / Remove templates - remove any admin templates from the GPO that are not in use - can this be done on a per GPO item or is this a global setting? Again I have only a few admin templates applied but they seem to be in every GPO I don't want to remove them from one and find it goes from all

 

Cheers

[localzuk]

I don't know whether you have done this or not, but if you have GPOs which only apply computer settings or only user settings, make sure you change the GPO Status under 'Details' in Group Policy Manager to 'user configuration settings disabled' or 'computer configuration settings disabled' etc...

 

I didn't bother with this all the time, as it didn't seem to make much difference, but I just changed this on half a dozen GPOs here and start up time went from 2 minutes to 1 minute on our machines.

[ToyHeartsFan]

 

You state editing each of your GPO's to reduce logon time ! - what do you mean by this? I'm only applying (hopefully) settings which are required - so would rather not take them out !

 

Can this be done on a per GPO item or is this a global setting?

Cheers

 

Hi

 

No dont take out any settings that are required just try not to duplicate settings e.g if you set internet settings in the default domain policy but override them for certain users (eg different home page, different proxy settings etc...) because doing this will increase the time it takes to process. Although the time difference might be very small if you have a lot of GPOs it can add up.

 

Yes you can remove admin templates per GPO - I would copy one of your GPOs and try it on the copy before you do it on the live GPO so that you know your not removing an admin template you need within that GPO. For example the GPOs we use to deploy software dont need any settings in any of the admin templates so we can remove all of the admin templates from those GPOs. - This made a difference for us but it depends how many GPOs you have, how fast your network is, the load on your servers etc...

 

The other thing that helped us a bit was to edit our logon script so where ever possible I removed any reference to a specific server and replaced it with the logon server variable

eg replaced: net time %server1% /set /yes

with: net time %LOGONSERVER% /set /yes

so the workstation doesnt have to wait for another server before it can continue to process the logon script

 

I think the thing that slows our logons down the most now is the way we deploy printers using the logon script, the printers are deleted and then installed at logon which slows things down a bit but means we can change printer allocation very easily.