Setting up a GPO in Active Directory?

Question

Active Directory

Colleagues, good afternoon!
A question concerning GPO in the domain.
Tell me how did you do it? Or how you often set up basic parameters in a GPO. I mean from the class: close user access to ProgrammFiles, prohibit flash drives, prohibit downloading files of a certain format, etc. It is interesting to know what minimum needs to be configured.

Answer 1

1) Password policy: what complexity, how often to change, etc.
2) User rights: who has the right to enter computers into the domain, start services and scheduler tasks.
3) Updating the operating system and installing programs.
4) Time synchronization (!). It is very important for domain clients not to experience significant out of sync.
5) Blocking user sessions when the user is inactive. Few people block the system by moving away from the computer.
6) Removing and disabling any garbage that users do not need or are not supposed to.
7) GPO update time, so that clients request it not only at the time of inclusion / authorization, but also during the day.

Answer 2

It depends on what level you have in the office and what kind of security policy is there.
An unambiguous answer cannot be given.
However, in most cases, this is the setting for receiving updates, pouring network settings, shortcuts to network drives, the necessary software (VNC, for example), setting up the Defender and Firewall to open the necessary ports, removing unnecessary programs like XBox-something-there, password policies , services.