Information Systems:Active Directory Group Policy - Implementation

Group Policy refers to the feature of Active Directory that allows for the deployment of computer and user settings to groups (of computers or users). This page discusses the implementation of Group Policy at uniPHARM. It was written after the GPOs were completely overhauled, and therefore often refers to the previous implementation and its problems.

Design

Prior to the current GPO implementation, there existed "monolithic" and bloated GPOs such as "Standard Settings for Managers without a Web Proxy". These GPOs contained the full set of settings, including Computer and User. This would lead to clones being made from it (for another OU) that were all redundant for the same base set of settings, with minor tweaks to them.

Atomic and Additive

Until I find better terminology, atomic and additive describe the general approach to how GPOs have been implemented. That is, GPOs are found in smaller, "atomic" GPOs that grouped related settings (in some cases just 1 setting), and these GPOs are linked to OUs as necessary e.g. mix-and-match from a pool. The spirit of what was intended in the design can be more easily seen by examining the GPO layout.

Separation of User and Computer Settings

Building on the previous concept of bite-sized GPOs, it is also a best practice to separate user and computer settings, and therefore current GPOs are prefixed with either a C or U. Because of this separation, OUs - to which GPOs apply - are now also split into two groups/hierarchies - one for computers and another for users (there's actually a separate one for servers too).

When making changes to GPOs or creating a new GPO, first determine whether the setting(s) is better implemented as a User setting or Computer setting, as many settings allow for both. In the case of a printer share, for example, you can configure computers to map the printer so that any user logging in gets the same printers, but it makes more sense for this to be a per-user setting. Refrain from the shotgun approach, which was also seen in previous GPOs: setting both computer and user settings in an attempt to get the GPO to apply to a particular scenario.

Annotating GPOs

It is good practice to leave comments on GPOs, especially when creating one (but also if you figure something out that wasn't already in the description). To do this, edit the GPO, and then right click in the Edit window -> Properties -> Comment tab.

Other Topics

Policy vs Preferences

As its name implies, Group Policy is about policy, which relates to policing and politics of control. User experience, in particular what they can be restricted from doing, can be heavily influenced or in some cases outright enforced, with Group Policy.

Mapped drives

The deployment of mapped drives through Group Policy has been changed (2021) to utilize item-level targeting. The intent behind this will be summarized here but is perhaps more easily seen by examining the GPO itself.

There are mapped drives that are common to all users of the company e.g. FormsGeneral, and those that are specific to each department. There is therefore a GPO for the former and multiple GPOs for the latter. However, these are all deployed to the same OU level (UWD Users), rather than the department OUs. This is because some users belong to 2 different departments, while a user can only belong to a single OU.

Nested OUs, Link Order and Inheritance

Nested OUs allow for layered application of GPOs. For example, the Accounting OU is nested within UWD Users, so members of this OU will receive both a GPO linked to Accounting and a GPO linked to the UWD Users. There is also a Default Domain Policy GPO that is applied since it is linked to the domain OU (root). This is known as inheritance. GPOs are applied in priority by proximity e.g. for Setting X that is enabled by the parent GPO and disabled by the child GPO, the setting will be disbled. Of course, this can be made complicated by the Block inheritance function which is set for an OU to block upstream GPOs that it would otherwise inherit. The previous OU/GPO layout had this enabled for all OUs. Now, it is not in use and we'll try to avoid it unless absolutely needed, for simplicity sake.

Folder Redirection and Roaming Profiles

The company used to do Roaming Profiles and Folder Redirection, but we've switched to just using Folder Redirection. A GPO is used to redirect the Documents, Desktop, and Music (or maybe Photos) folders to user profile folders on superserver (located in UserProfilesFR$ - yes, it's hidden). An important point regarding this GPO is that Security Filtering is set to only apply this GPO to the group Folder Redirection Users. This is because Folder Redirection is not desired for users whose main computers are laptops.

One currently unresolved aspect of Folder Redirection is Offline Files. After the Windows 10 upgrade, Offline Files - which is enabled by default - seemed to be causing issues and therefore I've been disabling it for users. The outcome appears to be good, so maybe a GPO to disable it for everyone is in order, but this has to be looked into further.