Home / server / Questions / 159650
Accepted
emtunc
Asked: 2010-07-13 08:29:43 +0800 CST

Merging group policies

  • 772

So basically, we have a dozen or more group policies which make the process of applying/changing/adding new policies a PITA.

What I want to do is merge all the policies together and basically end up having two - one for desktops and the other for laptops.

Is there a nice and easy way of merging all these policies together?

The server is running SBS 2003.

Thanks!

group-policy

1 Answers

  1. Best Answer

    There isn't an out-of-the-box tool to do what you want, nor am I aware of any third-party tools that would help. I think you're probably stuck with manually building GPOs that contain all the settings you want.

    Obviously, by combining all these settings together you're limiting your ability to be granular with applying only some of the settings in the GPO. I'd be sure you've thought your desired level of granularity through before you start with building-up the new GPOs.

    Edit:

    The desing trade-off in making GPOs is as such: Do you put a lot of settings into a single GPO, or spread the settings out over multiple GPOs. The advantage to a single GPO is quicker processing on the client (though on a LAN this won't be perceptible unless you have a LOT of GPOs) and less "stuff" to wade thru in the management interface.

    If you pile everything into a few GPOs, however, you run the risk that later you may only want to apply a subset of the settings to a subset of computers or users. Software Installation policy has a mechanism to filter by security-group at a sub-GPO level, but for all other parts of a GPO there is no mechanism to selectively filter application at a sub-GPO level. You end up having to create "anti-GPOs" to "undo" the settings in the large monolithic GPOs, or you break the monolitic GPOs up, manually, into GPOs that you then filter by security group (or WMI filter, or by linking at different OUs).

    It's probably not a big deal if you're not being very sophisticated with your use of Group Policy. I often have a "Domain-wide User and Computer Settings" GPO with very basic settings that I know will always apply universally. I'm careful, though, not to put settings in that GPO that might end up not needing to be universal later on, and create dedicated GPOs for those settings that I might want to toggle on/off for subsets of users or computers later.

    • 2