Practical tips on simplifying GPOs and OU organization

Summary: Deep paths within Active Directory can complicate Organizational Units and Group Policy Objects organization. IT pro Rick Vanover shares his approach to managing the complexity of GPOs.

 

One of the most powerful centralized administration tasks for Windows Servers and PCs is deploying Group Policy Objects (GPOs). So much so, in fact, that I could argue Group Policy is one of the best solutions Microsoft has ever provided.

While I’m very fond of GPOs and their flexibility to configure user and computer settings centrally, we can easily get out of control with conflicting rules and overly complicated implementations. I’m sure we’ve all seen a domain that has a very ugly configuration of GPOs, and let’s not even get started on the security groups.

In my Active Directory practice, I go back and forth in determining how deep the GPOs and Organizational Units (OUs) should go. I frequently don’t do more than three GPOs flowing in series with the OUs.

By series I mean one GPO in a parent OU and another GPO in a child OU, like Figure A where the green GPO applies to the parent OU and the red GPO applies to the child OU (as well as the green GPO).

Figure A 
 
Click the image to enlarge.

OUs are great for granular classification of various Active Directory objects, though I don’t really have an incredible issue going very deep (within reason) in terms of levels for this configuration. GPOs, on the other hand, are not good candidates for multiple applications for each OU as the tree goes deeper.

It is too complicated to keep the configuration rules in mind for planning and quick thinking. To help simplify how GPOs are organized, here are some tips:

• Leverage GPO filtering by security group to make more GPOs at a higher OU instead of more GPOs in deeper OUs
• Never add individual users or computer accounts (always use the group trick above)
• Combine user and computer settings by role, rather than separate GPOs
• Self-document the names of the GPOs to be intuitive to the role and location
• Use a consistent GPO nomenclature, including renaming GPOs to get there
• Scour around for GPOs that have one setting and consolidate it with other GPOs

GPOs are great, but the tools require organization and thought. These tips are general guidelines, and any of you keeping score will note that my screenshot from my personal lab is not exactly following all of these recommendations. It’s fine for a lab, but in production, that’s a different story.

Rick Vanover is an IT infrastructure manager for a financial services organization in Columbus, Ohio. He has years of IT experience and focuses on virtualization, Windows-based server administration and system hardware.

Also read:

 

Configure server, desktop, laptop power options with Group Policy

 

Disable Server Manager and Initial Configuration Tasks via Group Policy