I am looking to start working with our Active Directory Group Policy settings. I know to go about it carefully. I'm well aware they can wreak havoc.

Is it better to set the Group Policies at the "Default Domain Policy" or at "Default Domain Controller Policy"? Since I'm on that subject - what is the difference between them, anyway?

Anyone also know of a good guide to what each setting does? I look at the 300something settings and I'm not sur exactly what each one is.

THANKS