LITMIR.BIZ

      Group Policy Strategy: Should I Create More or Fewer GPOs?

      At times, you’ll want to lock down additional functions for a collection of users or computers. For example, you might want to specify that no users in the Human Resources Users OU can use the Control Panel.

      At the Human Resources Users OU level, you’ve already set up a GPO that contained a policy setting to hide the mouse pointers option in the Windows 10 Personalization page. You can create a new GPO that affects the Human Resources Users OU, give it a descriptive name – say, No One Can Use Control Panel– and then drill down through User Configuration⇒ Policies ⇒ Administrative Templates ⇒ Control Panel and enable the policy setting Prohibit Access to Control Panel.

      Or you could simply modify your existing GPO, named Hide Mouse Pointers Option/Restore Screen Saver Option, so that it contains additional policy settings. You can then rename your GPO to something that makes sense and encompasses the qualities of all the policy changes – say “Our Human Resources Users’ Desktop Settings.”

      Here’s the quandary: the former method (one policy setting per GPO) is certainly more descriptive and definitely easier to debug should things go awry. If you have only one policy set inside the GPO, you have a better handle on what each one is affecting. If something goes wrong, you can dive right into the GPO, track down the policy setting, and make the necessary changes, or you can disable the ornery GPO (as discussed in Chapter 2 in the section “Stopping Group Policy Objects from Applying”).

      The second method (multiple policy settings per GPO) is a teeny-weeny bit faster for your computers and users at boot or logon time because each additional GPO takes some miniscule fraction of additional processing time. But if you stuff too many settings in an individual GPO, the time to debug should things go wrong goes up exponentially. Group Policy has so many nooks and crannies that it can be difficult to debug.

      So, in a nutshell, if you have multiple GPOs at a particular level, you can do the following:

      ● Name each of them more descriptively.

      ● Debug them easily if things go wrong.

      ● Disable individually misbehaving GPOs.

      ● Associate a specific GPO more easily to a WMI filter (explored in Chapter 6).

      ● More easily delegate permissions to any specific GPO (explored in Chapter 2).

      If you have fewer GPOs at a particular level, the following is the case:

      ● Logging on is slightly faster for the user (but only slightly).

      ● Debugging is somewhat more difficult if things go wrong.

      ● You can disable individually misbehaving GPOs or links to misbehaving GPOs. (But if they contain many settings, you might be disabling more than you desire.)

      So, how do you form a GPO strategy? There is no right or wrong answer; you need to decide what’s best for you. Several options, however, can help you decide.

      One middle-of-the-road strategy is to start with multiple GPOs and one lone policy setting in each. Once you are comfortable that they are individually working as expected, you can create another new GPO that contains the sum of the settings from, in this example, Prevent Changing Mouse Pointers and Prohibit Access to Control Panel, and then delete (or disable) the old individual GPO.

      Another middle-of-the-road strategy is to have a single GPO that contains only the policy settings required to perform a complete “wish.” This way, if the wish goes sour, you can easily address it or disable it (or whack it) as needed.

      Here’s yet another strategy. Some Microsoft documentation recommends that you create GPOs so that they affect only the User half or the Computer half. You can then disable the unused portion of the GPO (either the Computer half or the User half). This allows you to group together policy settings affecting one node for ease of naming and debugging and allows for flexible troubleshooting. However, be careful here because after you disable half the GPO, there’s no iconic notification (though there is a column labeled GPO Status that does show this). Troubleshooting can become harder if not performed perfectly and consistently. In all, I’m not a huge fan of disabling half the GPO.