Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to know how I can create and deploy a local group policy with settings that exist in my domain GPO. I know local GPO only supports a subset of what domain GP does and I think that's where the problem exists. The settings I need to apply are contained within the Computer Config -> Policies -> Windows Settings -> security Settings -> system services, Wireless Network (802.11) Policies, and Wired Network (802.3) Policies. These three options do not exist in either XP or 7 local GPO.

I have investigated using secedit and security templates from the SCA snap-in but it doesn't appear that they contain these settings either.

So the question is simple, how can I apply the settings that are already configured in a domain GPO to a local GPO?

share|improve this question

migrated from Jan 11 '12 at 21:17

This question came from our site for information security professionals.

I don't quite follow... if It's already applied in a domain GPO then it doesn't need to be applied in a local GPO because the domain GPO gets applied. – Steve Jan 11 '12 at 17:06
Right. The problem is that I am using a domain policy to apply dot1x settings. Occasionally I have a client that fails to authenticate for some reason (network issue, acs down, etc) and when the client is disconnected from the domain, the domain policy does not get applied. When this happens, the authentication settings on the NIC change resulting in the workstation never being able to reauthenticate correctly again. I have to manually force-authorize the port, reboot to get the domain policy then put the port back to auto. – Paul Ackerman Jan 11 '12 at 17:19
Ahhh okay. That makes sense. Have you tried exporting the GPO and importing on the local machine itself? – Steve Jan 11 '12 at 17:35
What exactly do you mean by export/import? – Paul Ackerman Jan 11 '12 at 17:36
Sorry if that comment sounded ignorant but I've been trying to figure out how to do just that. I can't seem to find a way to "export" a group policy object. I even tried manually copying the policy files from the sysvol share to the %systemroot%\system32\grouppolicy folder but the files in the sysvol share didn't contain any settings oddly. – Paul Ackerman Jan 11 '12 at 18:01

You should be able to use the Group Policy Management Console to export the GPO as an inf and then move it to the target machine(s)

share|improve this answer
I see where I can create a "backup" within GPMC but this just creates a copy of what's in the sysvol share. A folder with the UID of the gpo with adm, machine and user inside - none of my settings. How do I create an inf from the GPO with GPMC?? – Paul Ackerman Jan 12 '12 at 13:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.