If you take the time to plan out Security Groups for users and computers,
2008 can do some amazing things compared to 2003, thanks to Group Policy
Preferences, Item Level Targeting, judicious use of computer policy versus
user policy, etc...
If you do anything, try to avoid linking to computer objects, or user
objects directly. Link to an OU if you prefer to use OU's, or link to a
Security Group that contains whatever objects that group is meant for.
Linking GPOs directly to objects can come back to haunt you.
Of course, the new 2008 goodies, are moot if your clients don't have XMLLite
(part of xp.sp3) and GPP Client Side Extensions installed.
Post by Florian Frommherz [MVP]Howdie!
On 08.04.2010 10:35, microsoft . public . windows . server . security
Post by microsoft . public . windows . server . securityis there any guidance onthe amount of gplinks that should be created?
in the context of a poorly designed OU structure where linking gpo's
to machines spread all over the OU structure. i am thinking of using a
wmi filter as that might have less impact on performance / gpo
processing time
No guidance here however I'd probably go continue linking GPs to the
machines where needed and step back from WMI filters. WMI filters (used
extensively) have more impact on overall performance of GP application.
Even worse, when using a GPO-A that has an WMI filter attached, that WMI
filter gets evaluated multiple times if a client has linked that GPO-A
multiple times.
You'll want to use WMI filters sparingly.
Cheers,
Florian
__________ Information from ESET NOD32 Antivirus, version of virus
signature database 5011 (20100408) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
--
[Robert]
__________ Information from ESET NOD32 Antivirus, version of virus signature database 5011 (20100408) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com