Is there a significant performance gain in reducing the number of GPOs in active directory?

Question

I have just started work on an existing 2003/AD domain where users are complaining about the amount of time it takes for an XP client to reach the logon prompt after boot (around 4 minutes).

I haven't looked into this too much so far, but one thing I did notice is that there are ~150 GPOs. Most of these could be reduced by manually going through and merging several into one. It looks so far like I could achieve the same outcome with about 30 GPOs. Luckily, the GPOs are well documented.

Some wireshark traces I have done seem to show each client checking the timestamp on each file in each gpo in the sysvol share when they boot (or on a group policy refresh). This takes about 25 seconds.

I am fairly certain there are other factors that are contributing to the long boot time of the clients, but in general, is it worth keeping the number of GPOs to a minimum?

Answer 1

Group Policy and the application thereof is a complicated topic. My suggestion before making an assumption that Group Policy is the cause of the slow startup/logon times would be to verify that your infrastructure is configured and working correctly before diving in to make Group Policy changes. You're probably on the right track but never make any assumptions about the cause of the problem until you have the evidence to prove it.

Is DNS functioning properly? Are the client computers configured correctly in relation to their DNS settings.

Are the domain controllers located correctly? Do you have more than one AD site and if so, are the appropriate subnets set up in ADS&S? Are the domain comtrollers in the proper site?

Have you run gpresults against a computer/user to verify the scope of management of GPO's that are being applied?

I would enable user environment debug logging on one of the client computers and look at the log. At the very least this will show you when GP processing began and ended for that computer/user.

Here are two articles that might help:

http://blogs.technet.com/b/ad/archive/2007/08/20/tracking-user-environment-creation.aspx

http://technet.microsoft.com/en-us/library/cc784268(WS.10).aspx

Answer 2

Yes, the more GPOs, the longer the startup and/or login process will take. You're on the right track. Minimize that, and then figure out the next contributing factor and fix it, until you and your users are happy.

Answer 3

As a good practice, you would have an own policy with a descriptive name for each coherent preference set. This way you retain better maintainability (e.g. you can granularily disable and re-enable single policies without having a whole bunch of settings not related to each other suddenly changed) and make your documentation work easier. If your clients are checking every single group policy object, you might have a rather flat OU structure with most of your clients residing in a single OU and all GPOs connected or inherited into this OU.

You might look into segmenting this into a more hierarchical structure so less policies would need to be processed by the clients.

There is also a generic performance optimization article posted as KB 315418 on the Microsoft site.