Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I realise there are multiple ways in which you can backup GPO's - via Powershell, via Group Policy Mgmt and so forth, but how in Windows are you able to backup not only the GPO's themselves, but their links to their respective OU's too? Is this achievable with these tools or would it require something like a System State backup to work?


share|improve this question
I believe that's what a system state backup is for. Keep in mind that group policies themselves are files stored in the sysvol of the domain controllers. The links are stored in AD, not the data. – uSlackr Jun 12 '12 at 20:35

OU links are stored in the AD Database. So a system state backup and AD restore would make the job. Every container has an Attribute called gplink. So if you take an ldifde dump of that attribute I guess you could re-import it later. I hope this help.

share|improve this answer

The actual links to a group policy object are stored in the organizational unit, domain, or site objects, in the attribute gpLink. It is a single-valued string attribute that holds all of the gpo's, delimited with each gpo object enclosed in brackets [].

The gPLink attribute holds a list of all Group Policy containers linked to the container and a number for each listed Group Policy container, that represents the Enforced (previously known as No Override) and Disabled option settings. The list appears in priority order from lowest to highest priority GPO.

If you wanted to do this manually, you could perform a global catalog query of all objects that have that attribute (gpLink=*). If you combine this with the output of the gpmc backup, you should be all set.

#$searcher.SearchScope="subtree"  #if you have child domains
$ADResults = @() 
foreach ($result in $results) { 
    $tempObj = New-Object psObject 
    $adProperties = $ 
    foreach ($propertyName in $adProperties.propertyNames) { 
       if (@($adProperties.item($propertyName)).count -gt 1) { 
            $tempObj | Add-Member -MemberType noteproperty -Name $propertyName -Value $adProperties.item($propertyName)} 
       else {
        $tempObj | Add-Member -MemberType noteproperty -Name $propertyName -Value ($adProperties.item($propertyName) | Out-String -Width 4096).trim()} 
       } # end foreach $propertyName 
    $ADResults += $tempObj 
} # end foreach $result 
$ADResults | select distinguishedName, gpLink | Out-File results.txt -Width 4096

Some of the links can be quite numerous. If you can find an occurrence of ... in the results file, that means you need a larger output buffer than 4096.

You may also find it useful to perform a query for objects that have the gpOptions attribute set. The gPOptions attribute contains the Block Policy Inheritance setting. It holds an integer value that indicates whether the Block Policy Inheritance option of a domain or OU is enabled (0) or disabled (1).

share|improve this answer

Try using the Advanced Group Policy Management tool from Microsoft, which is available for 'free' with the Desktop Optimization Pack if you have purchased software assurance licenses.

If I recall correctly, it backups GPO link information and also provides versioning, workflow controls, and a recycle bin for GPO's.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.