According to Helge's presentation (backed up by lots of stats and testing), disabling the relevant Computer or User part saves about 0.002 seconds of processing time per GPO. Could add up over hundreds or thousands of GPOs, but the takeaway he offered was that it makes no difference in real terms. I was surprised - I've been recommending people do that for years as well :)
From: [email protected] [mailto:[email protected]] On Behalf Of Kennedy, Jim Sent: 13 August 2015 18:50 To: [email protected] Subject: [NTSysADM] RE: Streamlining GPOs Make sure you disable the computer section of a gpo for a gpo that only has user settings, and the converse for computer gpo's. It really speeds things up if you do that, the box can completely ignore the whole section. One giant gpo is faster, but not dramatically imho. So I believe you have another issue here. Block them all on your test OU then enforce them one at a time...see if it is one in particular that is causing the issue. Also turn up gpo logging on the boxes to see where the delay's are. From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Kelsey, John Sent: Thursday, August 13, 2015 1:29 PM To: [email protected]<mailto:[email protected]> Subject: [NTSysADM] Streamlining GPOs We're seeing significant logon delays due to the high number of GPOs that have to get processed when a user logs in. We're trying to clean up and reduce the number of things that have to happen in order to get the user logged on faster. If we block all GPOs in our testing, we've been able to cut the logon time in half. So either we just have too many GPOs or a couple of them for whatever reason is crushing the logon. Is it more efficient to have 200 GPOs that set 1 item in each one? OR Is it more efficient to have 1 GPO that sets 200 items? OR Does it not make any difference in how long it takes to process? Thanks all. *************************************** John C. Kelsey Penn Highlands DuBois *: 814.375.3073 * : 814.375.4005 *: [email protected]<mailto:[email protected]> *************************************** [PHH ESig Logo 150dpi] This email and any attached files are sensitive in nature and intended solely for the intended recipient(s). If you are not the named recipient you should not read, distribute, copy or alter this email. Any views or opinions expressed in this email are those of the author and do not represent those of Penn Highlands Healthcare or its affiliates.. Warning: Although precautions have been taken to make sure no viruses are present in this email, the company cannot accept responsibility for any loss or damage that arise from the use of this email or attachments.
