Information Systems:Active Directory Group Policy - Implementation

Group Policy refers to the feature of Active Directory that allows for the deployment of computer and user settings to groups (of computers or users). This page discusses the implementation of Group Policy at uniPHARM.

Topics

Policy vs Preferences

As its name implies, Group Policy is about policy, which relates to policing and politics of control. User experience, in particular what they can be restricted from doing, can be heavily influenced or in some cases outright enforced, with Group Policy.

Separation of Computer and User settings

It is a best practice to separate user and computer settings. Previously, there were fewer GPOs with more settings in each one, leading to a monolithic GPO. Current GPOs are therefore prefixed with either a C or U, indicating wehther they contain either Computer or User settings, respectively.

Mapped drives

The deployment of mapped drives through Group Policy has been changed (2021) to utilize item-level targeting. The intent behind this will be summarized here but is perhaps more easily seen by examining the GPO itself.

There are mapped drives that are common to all users of the company e.g. FormsGeneral, and those that are specific to each department. There is therefore a GPO for the former and multiple GPOs for the latter. However, these are all deployed to the same OU level (UWD Users), rather than the department OUs. This is because some users belong to 2 different departments, while a user can only belong to a single OU.