This message was deleted.

Functional

Functional in most cases

Monolithic for me as I work in large enterprise. Functional creates a huge number of GPOs in a large enterprise where multiple teams may be managing it across desktop, server, etc. Functional is okay when a small team is managing. Different use cases requires different strategies.

Functional for me, but not ridiculously broken out into tiny blocks like some mad people do

Functional, but try to keep it to "one GPO, one CSE". Which makes Administrative Templates massive but it processes better

Yeah, I always go toward Monolithic myself. I try to do very few GPO with all settings myself. I was being told this slows down logs where functional processes better. But it depends I would say.

A couple of Group Policy MVPs (back when that was a thing) did a lot of testing on functional versus monolithic many years ago and found no performance degradation until you hit over 900 GPOs or a GPO with many hundreds of settings. I doubt any of us fit that scenario. They tested, for example, one GPO with 100 settings versus 10 GPOs, each with 10 settings. IIRC, monolithic "won" with a performance increase of .001 seconds. In other words, it doesn't make any PERFORMANCE difference which way you go. Now the management of the GPOs and settings is another story. Would you rather troubleshoot an issue with a GPO with 100+ settings or a GPO with 10 settings?

Monolithic in the grand scheme of things, though I do separate some stuff out purely for ease of management. For example: 1. Base GPO: Windows and O365 settings 2. Edge GPO: Edge settings 3. Citrix GPO: Setting the DDCs (everything else in Studio) If I had to separate them all out, I'd probably have another 2-4 GPOs to manage.

For me I only care about performance and logins to be honest. I certainly would lean towards 10 GPO for troubleshooting.

Hmmm, i tested mixed-up CSEs versus "one CSE, one policy" and got my overall logon time down from 35 seconds down to 24....

Well, on that note, I don't use GPPs at all if possible.

Yeah GPP I kick to the can myself

Not talking filters here, just straight changes to CSEs per policy

Yeah, I figured as much. We've had a similar conversation in the past.

I had to go read @James Rankin blog again on the master logins series he wrote up. The data in his blog doesn't lie and that is what I use to show prove when I need to prove to client's on GPO logins and processing

It does lie? 😉

Shit I mean doesn't lie( fixed that typo lol)

Anyway, make sure you always test in the enterprise environment you're in - my test was done on an environment where I had deliberately made the policies as convoluted as possible

Yeah agreed. Thanks for all the feedback and answers

I've got a client with 3900 GPP drive mapping policies (one policy, one drive map) and security filters applied to each. It actually works surprisingly efficiently, because each user can only see the policy objects they have access to (essentially it's just NTFS permissions from the security filter). But it must have been hell to set up

Holly cow, I'm speechless

They originally used Ivanti but the overhead of spinning up 3900 threads to do conditional group checks (because that's how Ivanti works) was killing the logons. So this was actually the least disruptive approach 😲

The worst I saw was thousands of GPOs: one per user to map one printer and each user could access up to ten printers. They did the same for drive mappings.

Yeah, I can't top that.

Not so bad if you security filter them all, but hell to manage, yeah

My new place isn't awful, but they've gotten into the habit of doing stupid shit that leads to longer logons. I'm trying to address it as best I can, even though I don't own that space. Already shaved 100 seconds off the logon, and I think we can do more.

It's not really a shave, more of an amputation

I like that

The best logon performance increase I have done is from 9+ minutes to 35 seconds and then to 9 seconds. They used mandatory profiles, so you would have thought the logons would be fast. BUT - the person who set up the mandatory profiles did it logged in with a domain admin account and spent a lot of time on the internet before saving the master profile. When a user logged in, the profile copied 35,000+ temp and image files and all were scanned with their AV. All that with several 1000 users logging in at the same time. Once they recreated the mandatory profile they were at 35 seconds. Then we analyzed a batch file used to map printers. It basically had: If MemberOf <group> map printer wait 5 seconds Endif For 35 printers!!! Just removing all the Waits, got the login time to 9 seconds.

I shudder to think of the artefacts each user had in their profile from that mandatory one

This discussion right here is why this Slack channel is so valuable.

functional here for easier location of settings and troubleshooting

functional but not going too deep, I like balance:)