http://www.dslreports.com/forum/One-big-group-policy-or-multiple-small-group-policies-23301072 en Fri, 10 Feb 2012 22:09:16 EDT Fri, 10 Feb 2012 22:09:16 EDT http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23304519
so that's my tip.
I would do more smaller ones, but]]> http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23304519 Fri, 06 Nov 2009 22:02:21 EDT http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23304297
I tend to make a default policy for the servers, workstations and users which contain policies that should be uniform across the board for that type of object. Then, as I create OUs, policies are created that are specific for those OUs.

Of course, now that I work for a large corporation, those policies come from corporate security, so I don't even get to touch them. Which is usually a good thing, but sometimes it causes problems.
--
Kilroy was here]]> http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23304297 Fri, 06 Nov 2009 20:56:29 EDT http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23303807
Things that apply to the organization go at the top and I typically group them together in a few large policies. I have one for the "Defaults" persay that we enforce, then the password policy object, then a few smaller ones.

Quite often I start out with a new setting in a new GPO object. After it's production-ready I apply it to a single OU, then ramp it up. I'd rather keep the break scope to a single container than the whole domain..Keeps the VIPs from being early adoptors and everything too.

Once it's "tried and true" I'll combine it into an existing policy. If it's a temporary policy (say a machine startup script for a project, something like that) it will remain in its own object and be linked that way.

Deciding which policy to tack settings onto, or which to combine/split, has a lot to do with your needed scope. If you intend to exclude OUs, using loopback, only really need it on a single OU, having it separated has obvious advantages. But remember, now when you add a new OU (new facility, new department, whatever) you have to link those small policies by hand. I hate going back and splitting GPO's I combined or lumped settings in initially...But I hate having to verify numerous objects for a single "function" (IE8 defaults, for example). So there's a middle ground that really depends on the administrator and the AD design..

How often you change the policy plays a big role too.

The best thing I can say to the OP and everyone else, is check out »207.46.16.252/en-us/magazine/200···erf.aspx .

Ok good, so it looks simple and straight forward.

Now look at an example of the official MS words on it.. »support.microsoft.com/default.as···&sd=tech

Long story short, if you're designing the policy with how often it has to be applied/changed/etc and all of that it's not an issue, especially on decent hardware/connections. Just keep your sanity in mind.. ;)
--
Baka wa shinanakya naoranai]]> http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23303807 Fri, 06 Nov 2009 19:00:26 EDT http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies0-23301795 http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies0-23301795 Fri, 06 Nov 2009 12:30:51 EDT http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23301595 1 Default Server

Those two have the very common settings such as allowing RDP, NTP source, WSUS source, password settings, etc

Then smaller ones for specific functions. ]]> http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23301595 Fri, 06 Nov 2009 11:51:26 EDT http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23301388 http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23301388 Fri, 06 Nov 2009 11:15:43 EDT http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23301335 http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23301335 Fri, 06 Nov 2009 11:07:09 EDT http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23301266 --
don't get 2 close 2 my fantasy]]> http://www.dslreports.com/forum/Re-One-big-group-policy-or-multiple-small-group-policies-23301266 Fri, 06 Nov 2009 10:53:34 EDT http://www.dslreports.com/forum/One-big-group-policy-or-multiple-small-group-policies-23301072 http://www.dslreports.com/forum/One-big-group-policy-or-multiple-small-group-policies-23301072 Fri, 06 Nov 2009 10:20:06 EDT