none
Disable User or Computer Settings - Still a Best Practice?

    Question

  • Back in the old days MS used to suggest that you disable User or Computer settings in a GPO if they were not used. Is this still recommended? Or have the optimizations in later OSes made this an obsolete practice? I can't seem to find any recent articles on this so I would assume that processing still takes place for the empty half but just wanted to confirm.

    Thanks!

    Tuesday, April 07, 2015 2:10 AM

Answers

  • > Back in the old days MS used to suggest that you disable User or
    > Computer settings in a GPO if they were not used. Is this still
    > recommended? Or have the optimizations in later OSes made this an
    > obsolete practice? I can't seem to find any recent articles on this so I
    > would assume that processing still takes place for the empty half but
    > just wanted to confirm.
     
    To be honest - if your OU and GPO design is well crafted, it doesn't
    matter. A computer will never have a look at the user part (be it
    enabled or not) and vice versa.
     
    If you have a lot of GPOs for e.g. computers, and if users happen to
    evaluate these GPOs as well, disabling the user part migth speed up
    processing by some ms - GPSVC only has to read the flags attribute and
    not the gpcuserextensionnames or version.
     
    The only benefit of disabling unnecessary parts IMHO is: If you happen
    to have an orphaned setting somewhere and - by accident or whatever -
    link that GPO somewhere where this orphaned setting gets applied, things
    can go wrong.
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    • Marked as answer by Matt McNabb Thursday, April 09, 2015 2:04 PM
    Tuesday, April 07, 2015 11:49 AM