Group Policy Question

[cpals]

I'm still learning active directory and group policies... my companies group policies were really screwed up before and we had a lot of problems and so far it's getting better.

I'm trying to get rid of any excess policies that we don't need and was wondering about the ADM templates for the group policies. This current GPO I'm working on has these templates listed under the Add/Remove Administrative Templates:

conf - 39kb
inetres - 1678kb
system - 1723kb
wmplayer - 66kb
wuau - 42kb


I'm just wondering if I can remove any of these templates from the GPO and if by doing this, it would slim down the size of the GPO to be loaded onto users' desktops.

 

[blemoine]

a good rule of thumb for group policies is to set only the ones you need. the policies you have configured the longer it will take to start up.

 

[cpals]

Originally posted by: blemoine
a good rule of thumb for group policies is to set only the ones you need. the policies you have configured the longer it will take to start up.

Correct, which is why I'm trying to figure out what these specific policies do and if I can remove them. I'm guessing the only main one I would have to keep would be the system config.

 

[Rilex]

Usually you would just disable one side of the policy, e.g. if your policy did not contain any Computer settings, you'd disable it via the Group Policy Management MMC.

 

[cpals]

Originally posted by: Rilex
Usually you would just disable one side of the policy, e.g. if your policy did not contain any Computer settings, you'd disable it via the Group Policy Management MMC.

Correct, but that does not get rid of the excess policy templates that are being loaded into the GPO and the end user has to download (I assume). All of those templates I listed are under the user configuration.

 

[blemoine]

what is taking time is the number of policies that each machine has to process. the templates are not what is slowing you down. for settings that you don't need leave them "unconfigured". only configure the settings that you need.

for example if the only thing you wanted to do with group policy was block users from changing there screensaver. you would only set that one policy setting. this would allow them to startup very quickly. but if you disabled all kind of other things while you were at it just because you could then they would take a bit longer to start up.

 

[cpals]

So it wouldn't matter if I had 10 ADM templates loaded, each 250kb in size... if I only changed one setting in one of the templates it would only send that one setting to the computer through the network?

 

[blemoine]

basically yes.