Jack, I also like Method A. We have "baseline" GPOs; one for workstations and one for servers since there are separate security policy requirements based on corporate security policies. And in those cases where I had explicitly disable or enable policies in policies on OUs further down the tree. For example, we had an OU for all workstations, then under that, one for desktops and one for laptops. The workstation-baseline policy caught all the corporate security policies; for instance, offline files are disabled, but on the laptop GPO, they are enabled. Robert _____ From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia Sent: Tuesday, September 19, 2006 11:37 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: GPO Implementation Methodology Jack- I typically like Method A better, but it has its drawbacks. Some policy, such as you've discovered with security policy, can't be easily undone. For example, in your interactive logon message example, you can't simply set it to Not Defined in the higher precedence GPO to have it undo the message. You would have to set it, but leave it blank, in order to undo that message. So, maybe the best solution is a mix of approaches, where you only put settings that universally apply to all computers in a set of few master GPOs and then apply specific settings at the OU level linked GPOs, using security filtering if you need to isolate groups of machines or users for specific settings. Darren _____ From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Kopenski, Jack Sent: Tuesday, September 19, 2006 7:59 AM To: GPTalk Forum Subject: [gptalk] GPO Implementation Methodology In trying to design a good GPO methodology for a medium size (7,500 employees) world-wide AD forest we are torn between 2 methods. Method A 1. Creating a master computer GPO for all settings common to the majority of our computers. 2. Creating "exception" GP's with a higher precedence to turn off individual settings set in the master GPO not desired for specific OU's . Or... Method B 1. Creating many individual GPO's for the majority of our computer OU's. 2. Simply leaving off an individual GPO if it is not desired for those machines. Method A would seem to create fewer GPO's, but can we always rely on the ability to turn off a setting already turned on by the master? Method B would seem to create more GPO's with a more complex precedence order, but simplify troubleshooting. I have run into a problem with Method A; after turning on the Security Options Interactive Logon Message in one GPO, I am unable to turn it off again in an exception GPO higher in the precedence order. Input would be appreciated. Thanks, Jack The contents of this e-mail are intended for the named addressee only. It contains information that may be confidential. Unless you are the named addressee or an authorized designee, you may not copy or use it, or disclose it to anyone else. If you received it in error please notify us immediately and then destroy it.