First published on TechNet on Oct 02, 2017
Hi Everyone, Paulo here, a Microsoft Premier Field Engineer (PFE), recently I have had several customers querying about how to deploy multiple AGPM Servers per Forest/Domain. As you know AGPM was designed to centralize change control over Group Policies so not exactly developed for this intended purpose. The configuration of Group Policy in a single AGPM server scenario is straight forward The AGPM server takes control of GPOs which copies GPOs into the AGPM archive enabling the AGPM server to control them and to do that the AGPM Service account must have Full Control over all the GPOs. Refer to my earlier AGPM related post for more information on that at https://blogs.technet.microsoft.com/reference_point/2013/08/21/how-to-prevent-the-creation-of-gpos-... However, by having multiple AGPM servers each AGPM service account can only control its own subset of policies (for example having an AGPM server/service per OU, Domain or Business Unit). Start by creating a Governing body/team which ultimately has an account which can change and create new GPOs in AD, and then they decide which AGPM Server will need to be responsible over this new Group Policy, so then they assign permissions to that new policy for the applicable AGPM service account. Channeling GPO creation through the Governing body prevents GPO creation outside of the AGPM. Each AGPM server has only control over the policies which they can see, which obviously is controlled by permissions. As an administrator you can create GPOs anywhere in the domain, which is a nightmare. So as business unit if you want a new policy, you must make a request to the governing body (or change control team whichever you like to call it). They'll create the new policy and set the permissions so that your AGPM server has exclusive full control over it. No AGPM service accounts can create policies (actually no one other than the governing body) or this model's purpose will be defeated. 