Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Tooter
Nov 12, 2003

I've been tasked with redoing our group policies at my company. I started by breaking up each department for things like printers, and drive mappings. I then went to muck around 2500+ options to make a new policy for the entire domain, WUS and the like. I ran into an issue that when I implemented the new policy it effectively broke all database connections. For the most part it was simple enough to fix, rebooted the servers (my boss wouldn't let me enforce the policy while we had the servers down to begin with), however, there were a few boxes that just died.
Our encoders are proprietary hardware and the SID's turned to 0's, breaking the entire system. Is this normal and if I go to make further changes is there a way to avoid this?
Also, we have 10 departments, so I have individual policies for each of those and then one for every day behavior. Is there a better way of making this happen? What special things besides WUS, security policies, etc, can I leverage to make our environment smooth like butter?

Adbot
ADBOT LOVES YOU

Tooter
Nov 12, 2003

skipdogg posted:

You really shouldn't ever dick around with the default domain policy too often.

I personally don't like creating one giant rear end GPO, for reasons you just mentioned, when poo poo goes down it's hard to pinpoint. I find it easier to make specific GPO's for one or two common settings and apply them selectively to needed OU's rather than creating a new blanket policy for the entire domain.

That's the way I was going originally but my boss wanted it the other way. I do what he wants to stay employed, told him what would happen but he thought I was wrong. Then everything broke. I'm slowly going through now and applying specific things to our groups, waiting for our servers to break again.

  • Locked thread