Tracking changes in Group Policy

I guess if I *HAD* to choose,
I think it's better to have more GPOs,
with less settings in them.

The client does drag.. but ONLY a little bit,
and only the first time you log on to them.
Afterward, I've found that because the client
only checks version numbers, and downloads
the ones it needs, addditional logons aren't that bad.

Okay.. 1 GPO with 100 settings **WILL** be faster
than 100 GPOs. Sure. And, of course that's the extreme case.

However, there is a "middle gound" to strike between
"too many GPOs clogging up SYSVOL with 4MB each"
and
"too few GPOs which I have a hard time getting granularity with."

The Zen middle path.. the Zen middle path. :-)

[kevsully]

With this example if you don't buy the performance issue, which can easily be tested and proven and a 'little' performance hit is surely relative, you are down to manageability.

Organization will design to best meet their needs and eveything is a give and take surely so some performance hit vs. manageabiltiy or get both easily managed and best performance... you choose.

Then we have reporting! What does 'more' GPOs mean? I have customers with over 300 and over 500 GPOs. Limited delegation, limited reporting options, no comparison reports.

Imagine the 300 issues. 300 * 4MB of SYSVOL data (at least). Not good. In small shops we will make decisions on different factors but this is not a slight issue, added to the ADM managemnet convolusion.

Back in the late '90s when we first started working with Group Policy in the pre-windows 2000 betas, Microsoft was making recommendations of new GPOs for every need. This was based on a lot of items. No Group Policy centric view of the world, that is here now, no reporting, that is almost here and a huge improvement over what was there, only surface delegation, that has improved now and settings based filters so that few GPOs can be effective across many, many users and systems. The last is not there with Microsoft's extensions but the vendors out there creating extensions do provide these types of targeting for thier extensions.

I will alway go with the 'do more with less' mentality. It is more productive and efficient. More overheard is never, (not just Group Policy) a better option in my book.

Kevin