Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have about 100 GPOs that I would like to merge down to 15-20. Is there a way of merging them together. I found this article:

http://blogs.technet.com/b/ashleymcglone/archive/2011/01/19/finally-copy-and-merge-gpos-powershell-saves-the-day.aspx

but there are limitations to its functionality that I can't not resolve without going through each of them one by one.

share|improve this question
    
I don't know the answer but you get a +1 for at least trying to consolidate the GPOs. –  John Gardeniers Jun 30 '11 at 2:05
add comment

2 Answers 2

There is no generalized functionality to do what you're looking for. Because of the modular nature of Group Policy and client-side extensions (CSEs), there can't be a generalized solution, per se, either. (Someone could write "merge" handlers for all the default Microsoft CSEs, but any third-party CSE would be its own problem.)

Architecturally, Group Policy can be extended to handle new kinds of settings. On the client end, these CSEs are DLLs that handle parsing the policy data for each different type of policy (IE Policy, Security Policy, Administrative Templates / Registry, etc). On the server side, the management console is extensible to allow third-parties to create management tools for their policy data. There is no standardized format for storage of the CSE data within the GPO. Registry policy uses a registry hive file, IE policy uses an IEAK template file, etc.

Microsoft didn't think to require third-party policy CSE administrative interfaces to have "merge" functionality so they don't. Call it short-sighted, but that's just the way it is.

What kind of stuff is in your GPOs besides registry policy that needs to be consolidated? Depending on what it is you may be able to write some code (or pay somebody to write some code) to do what you're looking for.

share|improve this answer
    
It's actually a little bit of everything, Auditing policies, permissions, reg edits, Bat files. –  BlindingDawn Jun 29 '11 at 21:56
    
@BlindingDawn: Yeah-- that's gonna be a pain. I hate to have to tell you that. If it's such an eclectic mix, though, it may be good to have a human go thru it anyway. That's a slew of GPOs (and I say this as a guy who has at least one Customer with 50+ GPOs in their 1000 PC network). –  Evan Anderson Jun 29 '11 at 23:27
    
I'll take "Things I didn't want to hear" for $1,000, Evan –  BlindingDawn Jun 29 '11 at 23:52
add comment

You might start with a tool that can compare GPO's to see what's in common (if anything) between all of the GPO's. Once you've got that you can start by building a new GPO that contains all of the common settings and work from there.

Be careful to avoid the temptation to buld a single monolithic GPO to handle everything. 100 sounds like too many but 1 is probably too few.

share|improve this answer
    
Can you suggest any such tool? –  Daniel Goldberg Jul 9 '11 at 8:57
    
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.