Green Sys admin asking...What are the basic "must have" GPOs that you set up for every new ADDS domain?

Exactly what it says above. You don't have to explain how to create them or whatever, but let me know what you think should be everyone's "non-negotiable" GPOs that every Windows domain should have in place?