Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We seem to be having a lot of problems related to "forgetting some mundane detail" while managing our Group Policy settings in Active Directory, so I am curious as to whether there are any well-regarded tools available for applying source control style practices to Active Directory configurations.

It seems like there should be a way to quickly and easily run a diff against a known-good configuration to figure out what setting changed (or did not replicate to a remote server) and is thus causing problems.


locked by HopelessN00b Dec 5 '14 at 6:36

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

up vote 4 down vote accepted

Take a look at Microsoft Advanced Group Policy Management which offers GPO change management. It's a pretty good tool that they bought from Policymaker a few years ago.

+1 This is becoming the officially supported solution for this situation. It does cost extra though I think. – Ryan Bolger May 4 '09 at 19:22
Thanks! This looks like exactly what we need to be using. I only wish the licensing / purchase options weren't so darn confusing. – Tim Lara May 5 '09 at 4:22
AGPM is very nice. It takes dedication because you cannot enforce its usage (thus domain admins have to play the game), but it's a very nice addition if you want to have serious change control in place. It's often overlooked and seen as a concept useful only to developers, but it's really worth it for group policies. If I'm not mistaken, it's part of the MDOP suite that is 'free' if you have a software assurance – dSebastien Jun 13 '12 at 14:39

NetIQ Change Guardian for Active Directory

I know nothing about it. Years ago we evaluated it( probably its predecessor) but never actually use it.


Out of the box there is no undo (although ntdsutil allows some recovering of deleted objects with an authoritative restore), or version control on AD. There are quite a few third party tools that will allow "undelete".


Not the answer you're looking for? Browse other questions tagged or ask your own question.