Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We seem to be having a lot of problems related to "forgetting some mundane detail" while managing our Group Policy settings in Active Directory, so I am curious as to whether there are any well-regarded tools available for applying source control style practices to Active Directory configurations.

It seems like there should be a way to quickly and easily run a diff against a known-good configuration to figure out what setting changed (or did not replicate to a remote server) and is thus causing problems.

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

Take a look at Microsoft Advanced Group Policy Management which offers GPO change management. It's a pretty good tool that they bought from Policymaker a few years ago.

share|improve this answer
    
+1 This is becoming the officially supported solution for this situation. It does cost extra though I think. –  Ryan Bolger May 4 '09 at 19:22
    
Thanks! This looks like exactly what we need to be using. I only wish the licensing / purchase options weren't so darn confusing. –  Tim Lara May 5 '09 at 4:22
    
AGPM is very nice. It takes dedication because you cannot enforce its usage (thus domain admins have to play the game), but it's a very nice addition if you want to have serious change control in place. It's often overlooked and seen as a concept useful only to developers, but it's really worth it for group policies. If I'm not mistaken, it's part of the MDOP suite that is 'free' if you have a software assurance –  dSebastien Jun 13 '12 at 14:39
add comment

NetIQ Change Guardian for Active Directory

I know nothing about it. Years ago we evaluated it( probably its predecessor) but never actually use it.

share|improve this answer
add comment

Out of the box there is no undo (although ntdsutil allows some recovering of deleted objects with an authoritative restore), or version control on AD. There are quite a few third party tools that will allow "undelete".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.