Domain Controller / Group Policy help needed

[neilcorbett]

Hi,

We have a Domain Controllers OU and a Servers OU. The DC one is a system generated OU and servers one we created.

We have a seperate GP for each OU but both have very similar settings, from an ease of admin point of view we would like to put all servers into one OU irrelevant of what they do ie member server or DC.

Just means we have to keep one GP configured instead of 2.

What is the best practice on this and any tips / advice?

Thanks

 

[NickFerrar]

Best practice is to keep them separate as you already have them. I'd create 2 GPO's, one for the generic server settings and one for DC specific things (such as you might want a larger security event log for DCs). Link the generic server GPO to both OUs and the DC specific one just to the DC OU and have that take precedence over the generic server one. That way most of your settings would be managed through the generic GPO but you'd still have flexibility to have DC specific settings.