The problem is that GPOs are really a terrible way to do configuration, and people (like myself) who grew up on them simply were Stockholm'd into accepting them

The problem is that GPOs are really a terrible way to do configuration, and people (like myself) who grew up on them simply were Stockholm'd into accepting them. The moment you learn about things like Ansible, and then ask "wait, what if I want to programatically make GPOs"-- and try to do so-- you realize just how horrendously bad they are. Their permissions inheritance is terrible, so trying to do least-privelege / granular rights for admins is awful. Their supercedence structure is confusing, overly complex, and naturally inclines people towards abusing "enforce" and "block" in the worst possible ways. Un-screwing GPO inheritance messes is essentially impossible, so in production the answer is generally "create a new GPO" rather than "clean up the old mess". And the settings structure itself is a terrible organizational mess; things "sort of" have a logical structure, except for the thousand odd exceptions. You can't set preferences on items that may not exist (such as disabling insecure services from old OSes) without generating a bunch of logged errors. You can't really target your GPO without some rather expensive client-side queries. Logging what is actually happening (e.g. why did that printer mapping fail) is awful, which I have generally seen solved by writing one's own drive and printer mapping scripts. The whole thing is a relic of the 90s that never quite got finished, polished, or maintained and mostly exists because it was "good enough" and there were no real alternatives. There still aren't, really, unless you want a third-party solution which is inevitably almost as big of a maintenance burden as GPO-- and GPO being free and mostly reliable makes it easy to just accept its awfulness.