2

First I'll say that I've just now discovered that my practice of making changes directly to the Default Domain Policy isn't the recommended way of doing things. I admit I'm not sure why this is the case, but I'll go with it.

Now, that said... I'm preparing to wipe and reinstall the OS for my WSE 2012 R2 PDC. I've made several changes to the Default Domain Policy over the past year—being careful to save a backup with each change—and I'm going to want to restore those changes to the new domain.

But I think this can't be done with my current backups, due to the new SIDs that'll be generated with the reinstall (among other unknown complications that may arise).

What I'd like to do is write a script/program against an API of some sort to read from the policy ONLY THE FEW SETTINGS THAT I'VE CHANGED and save them into a file for later restoration back to the new server. I don't have many, but I do have enough to make prohibitive a task of wading through the TreeView, tracking them down and manually copying them one-by-one.

The XML files that are produced by the standard GPO backup feature (as well as Backup-GPO) appear far more complex than the minimum necessary and I fear trouble if I use them to restore to the new GPO. I don't need all the plumbing, just the settings/values that I've changed from default.

In other words, I'm looking for a minimalist GPO backup/restore mechanism—even if I have to write it myself. The files produced by the current one seem to be overkill, like trouble waiting to happen.

  • Not for nothing, but if you edit the policy in GPMC you can filter on configured settings so that you don't have to wade through all of the settings. – joeqwerty Dec 27 '15 at 4:16
  • @joeqwerty: That seems to be for Administrative Templates only (and would still require a lot of manual work). Could you clarify? – InteXX Dec 27 '15 at 4:36
  • Yes, the filter will filter on only those settings that have been configured under the Administrative Templates node, either for Computer Configuration Settings or User Configuration Settings, whichever set of settings you've configured. I'm not suggesting that this is a solution, I'm suggesting that if you've only configured a few settings then this would be a quick way to see all of them without having to look section by section for configured settings. How is this a lot of work? You turn the filter on and then look at the settings that you've configured. – joeqwerty Dec 27 '15 at 4:40
  • @joeqwerty: It'd be a hefty task to manually take notes of each of the configured settings. But you know, I may have found the solution in Get-GPOReport. Granted I'd have to restore them one-by-one manually, but I might be able to live with that. – InteXX Dec 27 '15 at 4:46
  • OK, you said you only had a few settings so I thought I'd throw in my 2 cents. Glad you found what you were looking for. – joeqwerty Dec 27 '15 at 4:47
1

Not for nothing, but if you edit the policy in GPMC you can filter on configured settings so that you don't have to wade through all of the settings.

The filter will filter on only those settings that have been configured under the Administrative Templates node, either for Computer Configuration Settings or User Configuration Settings, whichever set of settings you've configured. I'm not suggesting that this is a solution, I'm suggesting that if you've only configured a few settings then this would be a quick way to see all of them without having to look section by section for configured settings.

Here's an example:

enter image description here

Additionally, the Settings tab for the GPO in the GPMC will also show you all of the configured settings. Again, if there are only a few, this might be quicker than trying to perform a backup/restore/migration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.