Best Practices for Group Policy The following best practices should be used for Group Policy:Use block inheritance, no override, and loopback sparingly. Their use makes the results of GPO application difficult to predict.Limit the number of GPOs applied to user and computer accounts. The more policies that are applied, the harder it is to determine what will happen, and the longer policy application may take.Do not use GPOs to do extensive file system and registry ACL assignment. Security settings in a GPO are applied every 16 hours. If these permissions are extensive, in a large enterprise, they can increase replication latency and possibly have a significant impact on DC performance.Use implicit deny where possible instead of explicit deny. When permissions are specifically granted, access is denied. Access can also be denied using Deny permission; this is known as an explicit deny.When planning the hierarchical application of security settings, be most restrictive with the first GPO applied, and then relax security where necessary to allow approved operations only by accounts within the container to which a GPO is linked. TIP: Disable Nodes in GPOsOne other thingdisable the user node in GPOs that modify computer settings and vice versa. When naming GPOs, use descriptive names so that you can look at a GPO and know what it does without having to do extensive digging and searching. "FolderRedirectMyDocs" is more descriptive than "UserNodeModificationLambda." |