J’ai set about 10 group-policies, and it works OK.
Although, it would be interesting to see what kind of things IT-administrators enforce.
Si vous have a ton of policies, just show some, that you feel really changes something.
I guess you could avoid “default permit” → block everything you can, and only keep things unlocked, that is directly needed.
This question refers to Windows Servers 
Although I won’t shun Mac nor Linux administrators.
I love Group Policy. It makes me able to do my job and to allow my company to leverage the collective talents of 3 people over more than 1,000 PCs and server computers in multiple Customer sites.
Nearly every one of my Customers has the majority of le suivant uses of Group Policy:
Install software with Software Installation policy
Install software with startup scripts
“Work over” machines’ factory Windows installations after their initial domain membership with a one-time startup script (Add/Remove Windows components, clean up the start menu, reomve unwanted vendor-provided software, etc)
Setup the “user environment” (Folder Redirection, Group Policy preferences to put out registry preferences, desktop shortcuts, etc)
When appropriate, “locking down” l’utilisateur environment (for kiosks, special-purpose PCs, etc)
Directing computers to WSUS servers and setting update policies
Setting IPSEC policy settings
Deploying wireless Ethernet settings (the corporate SSID and security configuration, etc)
Logon scripts to “map” “drives”
Logon scripts to clean out per-user “temp” directories, and startup scripts to clean out per-machine “temp” directories
Restricted group policy to populate local groups with domain groups
Control third-party applications that use registry settings to influence their behaviour through creation of custom Administrative Templates
Doing ANY type of misc. maintenance, either per-machine or per-user, that J’ai besoin de to do via startup or logon scripts
That’s my “off the top of my head” list. I’ll come back and revise if Je pense of more.