Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently automating the creation of our enterprise domain controller and its configuration in case of SAN failure etc. I can create the server, install the necessary roles, create complete ou structure, users and security groups etc. All simple powershell commands and a little logic.

However I am blocked on group policy. I have tested by backing up an existing simple group policy object that grants a user a specific permission. Tried to restore backup on new identical domain controller. Wont work. Created empty group policy object and imported settings. Cannot resolve identity.

Any ideas?

share|improve this question
Should probably also mention that having a single enterprise domain controller goes against best practice too. I would heartily look at getting a second DC in. Won't resolve SAN failure on its own but could be stored on alternate storage or as a physical box if needed. – Tim Alexander Aug 12 '14 at 16:30

That's not a very sound recovery strategy. You cannot simply re-create the same naming and expect things to work. Every object in AD has a security identifier (SID). Creating a lot of objects with the same names might look the same to you, but to AD they are all completely different because the SIDs will differ.

You should look into the proper way to backup and restore Active Directory, this simply isn't the way it's done.

share|improve this answer
Best practice advice from MS about this topic can be found here: – gtirloni Aug 12 '14 at 14:37
Thanks, my Google-fu was failing me on that. – ThatGraemeGuy Aug 12 '14 at 16:13

You can backup GPO's using the GPMC and restore them using the GPMC as well. I'm confused...were you trying to manually copy the GPO from a folder/file perspective instead? Like Graeme said, you shouldn't be messing with creating identical DC's in a domain in case one "fails" without taking the proper steps.

The following link has everything you need for backing up and restoring GPO's on 2012.

It also sounds like you are only running a single DC and hoping for DR methods for that one DC. You are much better off running at least 2 DC's and then you won't be going through this mess or all the manual steps/scripts you are hoping will achieve your DR state.

share|improve this answer
Sorry guys, there seems to be a bit of confusion here. There are of course a minimum 2 domain controllers in each of the relevant network segments. What I am working on is a procedure to bring the corporate network back up and running in the case of a disaster. First thing that comes to mind is SAN failure / flooding etc. I have been doing a bit more research and it looks like migration tables have resolved my problem. Procedure is as follows - new 2012 server, script AD installation, scripts OU structure script user accounts and script group policy restore into brand new domain. – dmckenna Aug 14 '14 at 7:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.