Putting users and computers in separate OUs makes it easier to apply computer policies to all computers and user policies to only the users. Don’t mix different types of AD objects in the same OUs instead, separate users and computers into their own OUs and then create sub OUs for each department or business function. Having a good OU structure makes it easier to apply and troubleshoot Group Policy.

Create a well-designed organizational unit (OU) structure in Active Directory However, even for the policies listed above, it is better to use separate GPOs. Use the Default Domain Controller Policy for the User Rights Assignment Policy and Audit Policy only put other settings in separate GPOs. The Default Domain Policy applies at the domain level so it affects all users and computers in the domain. Use the Default Domain Policy for account, account lockout, password and Kerberos policy settings only put other settings in other GPOs. Do not modify the Default Domain Policy and Default Domain Controller Policy

Here are Active Directory Group Policy best practices that will help you to secure your systems and optimize Group Policy performance. For example, Group Policy enables you to prevent users from accessing certain files or settings in the system, run specific scripts when the system starts up or shuts down, or force a particular home page to open for every user in the network. Group Policy is a series of settings in the Windows registry that control security, auditing and other operational behaviors.

Turn off recent files quick access gpo