4

I need to know how I can create and deploy a local group policy with settings that exist in my domain GPO. I know local GPO only supports a subset of what domain GP does and I think that's where the problem exists. The settings I need to apply are contained within the Computer Config -> Policies -> Windows Settings -> security Settings -> system services, Wireless Network (802.11) Policies, and Wired Network (802.3) Policies. These three options do not exist in either XP or 7 local GPO.

I have investigated using secedit and security templates from the SCA snap-in but it doesn't appear that they contain these settings either.

So the question is simple, how can I apply the settings that are already configured in a domain GPO to a local GPO?

8
  • I don't quite follow... if It's already applied in a domain GPO then it doesn't need to be applied in a local GPO because the domain GPO gets applied.
    – Steve
    Jan 11, 2012 at 17:06
  • Right. The problem is that I am using a domain policy to apply dot1x settings. Occasionally I have a client that fails to authenticate for some reason (network issue, acs down, etc) and when the client is disconnected from the domain, the domain policy does not get applied. When this happens, the authentication settings on the NIC change resulting in the workstation never being able to reauthenticate correctly again. I have to manually force-authorize the port, reboot to get the domain policy then put the port back to auto. Jan 11, 2012 at 17:19
  • Ahhh okay. That makes sense. Have you tried exporting the GPO and importing on the local machine itself?
    – Steve
    Jan 11, 2012 at 17:35
  • What exactly do you mean by export/import? Jan 11, 2012 at 17:36
  • Sorry if that comment sounded ignorant but I've been trying to figure out how to do just that. I can't seem to find a way to "export" a group policy object. I even tried manually copying the policy files from the sysvol share to the %systemroot%\system32\grouppolicy folder but the files in the sysvol share didn't contain any settings oddly. Jan 11, 2012 at 18:01

2 Answers 2

2

(This old question was bumped to the homepage by Community and hasn't yet been answered.)

In general: if a setting doesn't exist in Local Group Policy Editor, it cannot be imported.

The proposed solution for the original problem was trying to export GPO from a domain and import it to the Local Group Policy. Instead, it was correct that these settings are domain specific, which means it wouldn't help to export/import them under these circumstances.

While it is possible to export domain specific settings from one domain and import them to another domain using Migration Tables to reference users, groups, computers, and UNC paths in the source GPO to new values in the destination GPO, it is not possible to import such settings to Local GP.

An TechNet Community Support answer on Applying Domain GPO to standalone machines lists:

Following items contain security principals and can be modified using a migration table, these domain GPOs may not available in local policy:

  • Security policy settings of the following types:
    • User rights assignment
    • Restricted groups
    • System services
    • File system
    • Registry
  • Advanced folder redirection settings
  • The GPO DACL, if it is preserved during a copy operation
  • The DACL on software installation objects, which is only preserved if the option to copy the GPO DACL is specified

The Wireless Network (802.11) Policies and Wired Network (802.3) Policies from the question are both under System services from the list above.

1

You should be able to use the Group Policy Management Console to export the GPO as an inf and then move it to the target machine(s)

1
  • I see where I can create a "backup" within GPMC but this just creates a copy of what's in the sysvol share. A folder with the UID of the gpo with adm, machine and user inside - none of my settings. How do I create an inf from the GPO with GPMC?? Jan 12, 2012 at 13:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .