How to tidy up and document GPOs in AD on WS2016?
Asked by
TechyTurtle47
Hey everyone! I've started managing Active Directory in a Windows Server 2016 Standard setup, and let me tell you, it's a bit of a mess. I've noticed that many Domain Admins have made changes to Group Policies (GPOs) over time, leading to a disorganized structure and poor documentation. I'm looking for advice on how to tackle this. I want to document each GPO directly within the Group Policy Management Console (GPMC) instead of using external tools like spreadsheets, but I can't find a "Description" field there—maybe I'm just not seeing it? I'm interested in your thoughts on a structured approach to GPO maintenance, especially on these topics:
1. GPO Naming Conventions: How can I name GPOs clearly and consistently?
2. GPO Purpose/Owner: What's the best way to track what each GPO does?
3. GPO Management: How do you handle cleanup, delegation, and lifecycle?
4. Documentation & Control: Most importantly, how do you document GPOs to ensure clarity and control in the long run, preferably within GPMC? Thanks a lot!
Answers
To add notes to your GPO in GPMC, just edit the GPO, go to the top-right corner where you'll find 'Properties', and you should see a 'Notes' section. Anything you enter there will show up in the Details tab. I recommend keeping your policies single-purpose; for instance, I have a general GPO for browsers that manages both Chrome and Edge. And when naming conventions, I prefer to include what it applies to (like an office or country) and whether it’s user or computer specific, followed by the purpose, such as web browser settings.
Reply to this answer
KISS: Keep It Simple, Stupid! Always a good policy to follow.
Reply to this answer
It's crucial to ensure that each GPO serves a single purpose; mixing computer and user policies can complicate things. We use clear naming like _Computer_Google_Chrome-Config for policies that affect computers and _User_M365_Office_Config for user-only policies. This approach lets you easily identify the type and purpose of each GPO, making troubleshooting a breeze. You can check who the policy applies to in the Scope tab and the specifics in the Settings tab. Plus, don’t forget you can save an HTML report of settings if you need a record.
SysAdminSam: Totally get that! We also categorize based on whether it's enterprise-wide or division-specific.
ITWanderer: Good stuff! I'm having trouble finding where to write in the 'Comment' field—does anyone know how to do that?
Reply to this answer
Add your answer
Answers are reviewed before publication.
NotoriousIT: Thanks for the tip! I think I'll start including office/division in my names.
AdminAlly88: I add brief notes that include the change, a datestamp, and my initials. It's great to reference a ticket number or provide a documentation link for further details since there's a character limit.