Re: GPO Management
- From: Florian Frommherz <florian@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Thu, 19 Oct 2006 19:14:43 +0200
Howdie!
Bad Beagle wrote:
This is just a question for best practices or suggestions from administrators with lots of GPO experience. Is there any pros/cons to creating individual GPOs or to creating single GPOs with a lot of settings? I started creating single GPOs to ease management of them - knowing exactly what each one does. But now that I am getting more and more GPOs I wonder if it is more efficient to have fewere GPOs with more settings or more GPOs with single settings. Any feedback is appreciated.
As I have not read any paper from Microsoft that does state any best practices on this topic, I'll give you information about how I handle Group Policies myself.
I first group users and machines into OUs as far as possible - for example I separate the notebooks from the servers and normal desktops, put workers from outside into different OUs than people within the building and so on. This helps me creating policies for the particular groups of machines and users without messing around with "Block inheritance" or NTFS rights. Try to create logical groups by thinking of the administration of the policies. The basic question is: how can you group your (user and computer) objects in AD in a way that lets you have less administrative effort with GPs?
I then put my policies into logical groups - for example "Office settings" or "Desktop Changes", "Security settings" with for example Windows Update settings, Firewall settings etc. The number of settings in a single GPO can be up to 999 if I remember right. But I try to keep the number as low as possible but as large as needed to keep a clear structure in this. The number of how many settings I have in a policy does vary. You might find the right balance yourself.
I do also use the Microsoft Group Policy Management Console which can create quick HTML reports of policies. By clicking the policy and creating the report you can easily see what settings a policy has activated. That makes GP administration a little easier...
cheers,
Florian
--
Nachwuschsadmin aus dem Süddeutschen/Germany.
eMail: Vorname [bei] frickelsoft [Punkt] net.
blog: http://www.frickelsoft.net/blog.
.
- References:
- GPO Management
- From: Bad Beagle
- GPO Management
- Prev by Date: Re: GPO testing
- Next by Date: Re: New to Group Policy
- Previous by thread: GPO Management
- Next by thread: Re: GPO Management
- Index(es):
Relevant Pages
|
