Use common sense naming conventions for GPOs. Don't use the same name for two different GPOs.
When you are working with Group Policy Objects, disable unused parts of the object.
When you delegate creation of GPOs to non-administrators, also consider delegating the capability to manage the links for a specific OU.
Use the No Override and Block settings in GPOs sparingly.
Do not redirect My Documents to the home directory unless you have already deployed home directories in your organization.
Enable client-side caching, especially for users with portable computers.
Always enable the Synchronize All Offline Files Before Logging Group Policy setting to ensure that offline files are fully synchronized and available to users working offline.
Use fully qualified (UNC) pathsfor example, \\server\share.
Avoid applying group policies to sites; instead, apply them to domains and organizational units.
Use RSoP to help you determine a set of applied policies and their precedence.
Software packages must be in the format of an .msi package; otherwise, the package cannot be pushed using Group Policy.
Configure software pushes at the highest levels possible so that the push goes out to a broader group of OUs. However, if the push is going out to only a few OUs, the software should be pushed from the OU level.
Configure software pushes to the Computer Configuration rather than the User Configuration.
Use DFS for multiple-site software installation MSI locations. Using DFS ensures that software installations are installed at the closest source for installation.
Force after-hours automatic reboots if possible. Use a remote shutdown command (such as the DOS shutdown command or VBScript) to force computers that are to receive a software push to install software after the users have left for the day.
Know the implications of using the Authenticated Users group to push software. Despite its name, Authenticated Users actually includes both users and computers.
