there are several group policies that i think a Active directory must have. which are what we can't live without in my IT department.

1. default domain policy
every active directory domain has it because it was there after you install a domain server, do not change most of them, we only use it to change the user account setting such as password policy, lockout duration.

2. automatic install default software for client computers
Group policy
this gpo installs software for you, zip tools, office ware, or industrial software.
we use it to automatic install about 20 software to all windows xp client computers. most of them are freeware.
these software are assigned to computer in a gpo: computer setting\software settings\software install\*

3. optional/ install-on-demand software for all users.
in this gpo, we publish software to all user instead computers. user can install them at their favor in their control panel >add/remove software>add software. some software is configured as install-on-demand that related to file extension. they only auto-install on user click to open some kind of files such as .mdb.

4. modify computer settings
this GPO only modify registry key on client computers, it configures firewall, update server, user interface, homepage,ODBC configuration. etc.

5. disable something
users dislike this GPO very much. because it disable computer games, network access to confidential documents, restrict them from some work unrelated/unneeded access.