I tend to see a lot of one off fixes for setting up and fixing group policies that either don’t exist or are intended for policies that are broken the majority of the time when I am looking up GP answers on teh google’s. I recently watched a great video over at the channel9 website by Daren Mar-Elia of GPOguy fame about using best practices and design principles for managing your Group Policy environment. Here is the link to that video.
That video really got me thinking about the topic of how I could improve my GP management skills in my day to day environment. So I decided that I would take as many offerings from his talk and elsewhere in my searches across the interwebz to help come up with some of my own best practices and guidelines for managing Group Policy.
The following is an overview of the ideas and techniques that I came up with and what has worked well in my experience with regards to managing Group Policy.
Group Policy organizational best practices:
- Use either a “U” “S” or “C” to denote whether Group policy is User, Server or Computer
- Tack on a version at the end of the specific Group Policy. Brand new Group Policies begin at v1.0
- Every time a policy changes increment the version number. It makes things easier to troubleshoot when using gpresult with this method
- Each GPO has one specific use case. DO NOT LUMP MULTIPLE FUNCTIONS INTO ONE POLICY
- Use very detailed and descriptive names to denote what a GPO is and does
Here are some example policies that I have been working on in a test environment. I think it captures many of these above best practices quite nicely. Please feel free to adapt this technique to suit your own specific needs, this is only a template and I’d like to see how it can be improved.
As you can see, using this format it is easy to tell whether or not this is a computer policy, what specifically the policy is doing and which version of the policy we’re at currently.
The most crucial part of using this system is to get other Group Policy admins to buy in to this technique. If you don’t clearly lay out your expectations then keeping policies up to date and organized could potentially become a pain point looking on down the road. The other caveat is to get the other GP admins in the habit of creating policies that address only one specific task, that are broken into either user or computer policies and have descriptive names. If the environment utilizes multi-purpose policies that contain both user and computer specific settings then this may be a new concept for many of the admins but the extra effort in setting this type of environment up will be totally worth the extra overhead initially.
I definitely think that this technique can be improved and I am always tinkering with it to see how I can get it to work better but for now it is at a good point. If you make the transition to organizing and improving your management of Group Policy or just have some solid best practices of your own already let me know, I would love to hear about what you are doing and how to incorporate more techniques into my own management style.
