Best way to deploy Group Policy Objects...

Posted on 2009-12-17
Last Modified: 2012-05-08
I'm asking this question to get some feed back on how you guys deploy GPO's. I'm a heavy user of GP, but never had one or a group of people say this is the way they do it because... My question is, do you deploy a GP for a specific task such as mapping drives and that's it or do you deploy a lot of actions into one GP, such as printers, drives, shortcuts and other items. I can see the win-win for doing it both ways, but just wanted to ask you guys and see the way you do it and maybe a reason for it. I really do not think there is a bad way to do it, but wanted to get some feedback on it. Thanks for the discussion guys, it is greatly appreciated.
Question by:ChiBot
    LVL 70

    Expert Comment

    Its always a compromise between having a small number of GPOs with lots of settings (that get applied quickly but are more of a problem to manage), and having lots of GPOs each doing a specific thing (which takes longer to apply but is easier to manage).
    LVL 13

    Expert Comment

    I do a lot of stuffs through GP. I don't put a lot of actions in one GP and i don't think that's the best way to do.

    Author Comment

    It is something that I have always thought over. I'm not in a large organization by any means, so it is easy to break them off into single GPO's and not have 100s. I posted this because I'm really rethinking my GP because of the new preferences they added with the release of 7/2008. Just so much more to control and wanted to get a feel of what other people are doing. Thanks for your quick responses.
    LVL 35

    Accepted Solution

    This is definitely open for alot of discussion. We have some gpos that are configured both ways. Our default domain policy has many settings in it that we use to get the computer to the baseline we would like. We also have other single gpos that do specific modifications or updates for systems when necessary.

    I kind of like the idea of having individual GPOs for each options you would like to configure. In my mind it is just easier to track down an issue or conflict if you know exactly what each GPO does and there arent a million settings in them.
    LVL 57

    Assisted Solution

    by:Mike Kline
    Yeah I agree with everyone else, it depends.  I just wanted to post a great article by top GP MVP Darren Mar-Elia.  From Technet Magazine last year...very well written article.  That is where I learned that disabling the computer or user section of a GPO did nothing...I was wrong on that for so many years :)
    Optimizing Group Policy Performance

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    At least once a month I see a Question in one of the Windows Server related Zones asking about Best Practices for GPO Security.  I have been in IT for 20 years, and a Sys Ad for over 15.  I know this will sound cliché, but this is mostly a preferenc…
    Synchronize a new Active Directory domain with an existing Office 365 tenant
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now