So basically, we have a dozen or more group policies which make the process of applying/changing/adding new policies a PITA.

What I want to do is merge all the policies together and basically end up having two - one for desktops and the other for laptops.

Is there a nice and easy way of merging all these policies together?

The server is running SBS 2003.



There isn't an out-of-the-box tool to do what you want, nor am I aware of any third-party tools that would help. I think you're probably stuck with manually building GPOs that contain all the settings you want.

Obviously, by combining all these settings together you're limiting your ability to be granular with applying only some of the settings in the GPO. I'd be sure you've thought your desired level of granularity through before you start with building-up the new GPOs.


The desing trade-off in making GPOs is as such: Do you put a lot of settings into a single GPO, or spread the settings out over multiple GPOs. The advantage to a single GPO is quicker processing on the client (though on a LAN this won't be perceptible unless you have a LOT of GPOs) and less "stuff" to wade thru in the management interface.

If you pile everything into a few GPOs, however, you run the risk that later you may only want to apply a subset of the settings to a subset of computers or users. Software Installation policy has a mechanism to filter by security-group at a sub-GPO level, but for all other parts of a GPO there is no mechanism to selectively filter application at a sub-GPO level. You end up having to create "anti-GPOs" to "undo" the settings in the large monolithic GPOs, or you break the monolitic GPOs up, manually, into GPOs that you then filter by security group (or WMI filter, or by linking at different OUs).

It's probably not a big deal if you're not being very sophisticated with your use of Group Policy. I often have a "Domain-wide User and Computer Settings" GPO with very basic settings that I know will always apply universally. I'm careful, though, not to put settings in that GPO that might end up not needing to be universal later on, and create dedicated GPOs for those settings that I might want to toggle on/off for subsets of users or computers later.

  • Could you further explain your latter point in not having enough granularity if the policies are merged?
    – emtunc
    Jul 16 '10 at 14:15
  • I dropped an edit on describing this design consideration. Jul 16 '10 at 15:17
  • Yes that makes a lot of sense and it's something that I thought of before. It makes more sense, like you said, to have a universally accepted and used policy, and along side that, several 'domain specific' policies; such as those for laptops and such. Thanks for clarifying!
    – emtunc
    Jul 16 '10 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.