FullArmour has a critical product for Active Directory. In enterprise environments, AD group policy can get very complex. Fazam adds version control and change control for GPOs. Highly recommended. From the FullArmour site :

FAZAM 2000 Version 3 provides complete Life-Cycle Management for Group Policy. It builds on Microsoft's native Windows 2000/XP infrastructure to provide the most comprehensive Group Policy management solution on the market.

FAZAM 2000 Version 3.0 includes Change and Release Management, a critical best practice for implementing Group Policy. Administrators can track the history of Group Policy Object (GPO) changes, including who made the changes, from initial design to retirement.

Version 3 New Benefits

• Tracks changes to GPOs.
• Provides version control for GPOs.
• Allows new or changed GPOs to move into production only after being tested and approved.
• Eliminates the risk of making changes in a live, production environment.
• Prevents two or more individuals making simultaneous changes to the same GPO.
• Reduces risk when delegating GPO administration.

Version 3 New Features

• 4 Ws of GPO Change:
  Version history for any GPO is available on-line and shows who made the change, what was changed, when the change was made, and why the change was made. For any entry in the GPO history, FAZAM 2000 can produce a full report of the GPO as it existed at that point in time. The report may be viewed online, printed, saved as an HTML file or saved as a MS Access file.
• Check-out and Check-in:
  GPOs must be checked out before editing. Only the person that checked out the GPO may edit it.
• Difference and Comparison Reports:
  Determining differences and comparing GPOs is automated. A GPO can be compared to: another version of the same GPO; an archived version of a different GPO; or to the version of the GPO that is in live Active Directory. The reports can be viewed online, printed, saved as an HTML file or saved as a MS Access file.
• Off-line Changes:
  GPO changes are made off-line and can be subject to normal testing, approval and release processes.
• Delegation:
  Authority to create and change GPOs can be limited preciously so that GPO administration can be delegated with reduced risk.
• Rollback:
  GPO rollback allows a prior version of a GPO can be put back in production.
• Documentation:
  GPO documentation may be viewed on-line, printed, saved as an HTML file or saved as a MS Access file.
• Replication and Synchronization:
  GPOs can be easily replicated and synchronized from domain to domain and across forests - even disconnected forests - for consistency.
• Baselining:
  GPOs can be baselined so that it is always possible to go back to the original settings.
• GPO Health:
  Administrators can determine the health of their Group Policy environment by running reports to discover GPO corruptions and replication problems.

Additional Features

• GPO Reporting:
  Allows IT Administrators to view detailed reports on GPOs in Active Directory through the MMC console or Web Browser.
• Resultant Set of Policies:
  Provides Resultant Set of Policies (RSoP) or the set of effective policies that apply to a user when logging on to a machine. Also allows for enhanced 'What/if' Scenarios.
• Policy-centric view of AD:
  Provides a view of Active Directory with Group Policy links and filters.
• Backup/Restore:
  Allows administrators to backup and restore individual GPOs on a domain including filters and links.
• Troubleshooting and Diagnostics:
  Provides administrators with the ability to perform remote diagnostics from a central administrator console.
• Search:
  Provides searching for GPOs and settings within GPOs.
• Scripting:
  Provides scripting of the backup, import, and reporting of GPOs.