Quite a few; they tend to ping-pong between low numbers and high numbers. Right now the numbers are high on account of a number of WSUS policies that need to be consolidated. I don't think GPOs are the kind of thing that are ever really "finished", but instead get constant fine-tuning and refinement as time goes by.
Primary uses include:
- Desktop lockdown
- Software installation
- Logon (and logoff) scripts
- Startup (and shutdown) scripts
- WSUS config
- Folder redirection
One - maybe - novel use is a logon script that (1) checks if the computer is a server, (2) checks if the user is a "sensitive" one that we want to track, and (3) sends an email to our admins giving computer name, user name and time if either condition is met. We call it "proactive paranoia" and while it's not exactly security, it is an extra layer of comfort in that we know a little bit more about what's going on.
We also maintain some dummy OUs in our live AD that we occasionally drop some users and/or computers into for testing out new stuff, and have a small army of scripts that we can add anywhere for certain one off jobs (e.g if we feel like defragging all PCs any time we can just drop in a shutdown script for it).
Future plans include moving a lot of the vile registry hacks and maybe some other stuff from our main logon script over to Preferences.