Restoring a particular GPO

Is it possible to restore a particular GPO using a system state backup?
Assuming that the GPOs by themselves weren't backed up separately by using
GPMC and right clicking and backup method.

Thanks

Yes, at least you can get the files, you need to know the Hex identifier
(particular policy, right hand side, Details tab, Unique ID:) of the
particular policy, but there will be a folder with the same Hex number in the
sysvol policeis folder. If you don't know the number, you may need to do
some detective work to figure it, process of elimination maybe.

I would likely create a new policy, and replace the new files with the old
to get the policy back, although there may be a more offical way to do it.

"study" wrote:

> Is it possible to restore a particular GPO using a system state backup?
> Assuming that the GPOs by themselves weren't backed up separately by using
> GPMC and right clicking and backup method.
>
> Thanks

Thanks. If I know the hex id then I can simply copy and paste from the
restore to the current sysvol locatioin?

"blankmonkey" wrote:

> Yes, at least you can get the files, you need to know the Hex identifier
> (particular policy, right hand side, Details tab, Unique ID:) of the
> particular policy, but there will be a folder with the same Hex number in the
> sysvol policeis folder. If you don't know the number, you may need to do
> some detective work to figure it, process of elimination maybe.
>
> I would likely create a new policy, and replace the new files with the old
> to get the policy back, although there may be a more offical way to do it.
>
> "study" wrote:
>
> > Is it possible to restore a particular GPO using a system state backup?
> > Assuming that the GPOs by themselves weren't backed up separately by using
> > GPMC and right clicking and backup method.
> >
> > Thanks

"study" <study@discussions.microsoft.com> wrote in message
news:83E463DB-A125-472B-AD1A-CA3BDD1F1D2F@microsoft.com...
> Thanks. If I know the hex id then I can simply copy and paste from the
> restore to the current sysvol locatioin?


Yes, but not recommended. Read my following blog for more info...

---
Recovering GPOs

Default Group Policy objects become corrupted: disaster recovery (for Domain
GPO and Domain Controllers GPO)
http://technet.microsoft.com/en-us/l.../cc739095.aspx

As for adminstrator created GPOs, you would need a backup. You don't want to
simply copy a syvol folder. GPOs are made up of two parts, the container in
Sysvol and its reference in the AD database. Copying a sysvol folder will
cause a sysvol mismatch condition, that I'm sure you don't want. You can
copy GPOs from one domain to another by using the GPMC console.

Copy GPOs using GPMC
http://technet.microsoft.com/en-us/l.../cc785936.aspx

How to restore deleted GPO policy files to Active Directory on a computer
that is running Windows 2000 Server
http://support.microsoft.com/kb/842252

"Restoring a Domain Controller Through Reinstallation and Subsequent Restore
from Backup" and "Procedures for Restoring a Domain Controller Through
Reinstallation
and Subsequent Restore from Backup"
http://technet.microsoft.com/en-us/l.../bb727048.aspx


Or the alternative to copy GPO using the GUIDs:

Copy Group Policy Settings

Scenario:

You need more than one Group Policy Objects and few settings are similar and
few are not but the amount of configuration is time consuming. You can avail
this by copying the Group Policy settings from SYSVOL folder to destination
GPO.

You will see policy contents of GPO created in SYSVOL folder in Policies
sub-folder and then copy them to the newly created GPO.

Win2K stores the actual GPO data in %SystemRoot%\SYSVOL\sysvol\\Policies\{}.
To copy a GPO, perform the following steps:

Determine the GUID of the GPO that you want to copy.
Create a new GPO in the target domain.
Determine the new GPO's GUID.
Navigate to the new GPO's storage area
(%SystemRoot%\SYSVOL\sysvol\\Policies\{}), and delete the contents of that
folder.
Copy the contents of the GPO folder from the original domain into the new
GPO location.

For example, imagine I have an original GPO named Test in the savilltech.com
domain and a GUID of 5AA140D1-397A-4B5C-B4DC-DF60FF731FC0. To copy this GPO
to a new GPO named Sales in the ntfaq.com domain, I would perform the
following steps:

Create a new GPO named Sales in the ntfaq.com domain.
Determine the new GPO's GUID (e.g., 600140D1-397A-4B5C-B4DC-DF60FF73XXXX).
Navigate to the new GPO's storage area
(%SystemRoot%\SYSVOL\sysvol\ntfaq.com\Policies\{600140D1-397A-4B5C-B4DC-DF60FF73XXXX}),
and delete the contents of that folder.
Copy the contents of
%SystemRoot%\SYSVOL\sysvol\savilltech.com\Policies\{5AA140D1-397A-4B5C-B4DC-DF60FF731FC0}
to
%SystemRoot%\SYSVOL\sysvol\ntfaq.com\Policies\{600140D1-397A-4B5C-B4DC-DF60FF73XXXX}.

Be aware that you won't have both folders on one machine; instead, you'll be
copying files between DCs

Also beware when copying between domains in different forests, that settings
may not apply due to differences in settings.

Basic Procedure:

A. First note down the GUID of Old GPO you want to copy:
1. Open ADUC
2. Right click on OU > Property
3. Switch to Group Policy tab
4. Click GPO > Property > note down the GUID of this GPO.
B. Next create the new GPO and find out the GUID in the same manner.
C. Follow the steps outlined below to copy contents of old GPO to new GPO
you created in step B.
1. Finally goto SYSVOL\domain_name.com\policies\GUID of old GPO
2. Copy the contents of this GPO.
3. Next goto SYSVOL\domain_name.com\policies\GUID of new GPO
4. Paste the contents here or overwrite.
D. Finally make whatever changes you want to make to the copied policy.

All in all, I would still recommend using the GPMC tool to do this, and not
manually. The manual method was from the 2000 days before the GPMC existed.

---


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
aceman@mvps.RemoveThisPart.org

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

"Efficiency is doing things right; effectiveness is doing the right
things." - Peter F. Drucker
http://twitter.com/acefekay

Hello study,

Also see this article about restoring single objects:
http://technet.microsoft.com/en-us/l...16(WS.10).aspx

Here is a complete overview:
http://technet.microsoft.com/en-us/l...72(WS.10).aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Is it possible to restore a particular GPO using a system state
> backup? Assuming that the GPOs by themselves weren't backed up
> separately by using GPMC and right clicking and backup method.
>
> Thanks
>

Howdie!

study schrieb:
> Is it possible to restore a particular GPO using a system state backup?
> Assuming that the GPOs by themselves weren't backed up separately by using
> GPMC and right clicking and backup method.

It is important to know that a GP consists of actually two parts: the
SYSVOL object (the so-called GPTemplate) and the Active Directory parts
(the so-called GPContainer). You'd want to restore both of them
authoritatively. Since this is sort of time consuming, I would suggest -
if you have a write-up of all settings in the GPO and metadata to it -
you create a new policy and re-configure settings in there.

I think Ace's blog entry is what you really want to try. As you can see,
manually backing up and restoring GPOs is sort of a pain in the arm - so
GPMC really is your tool of choice - always.

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste