2 ONS. 1 OFF. | Things you should know.

What happens when you delete a Group Policy Object (GPO)? You restore it from backup right? Well as it turns out, this is a much more complicated process than you’d imagine. Here is a simple solution that I rolled out to automate GPO backups, allowing for simple restores of GPOs (deleted or not).

First you should know that Microsoft includes a small handful of useful scripts with the Group Policy Management Tool. You can find them here: %programfiles%\Gpmc\Scripts (2003) or here: %ProgramFiles(x86)%\Microsoft Group Policy\GPMC Sample Scripts\ (x64 2008). The one We’re looking for today is called BackupAllGPOS.wsf and it does exactly what the name implies. Usage is as follows:

BackupAllGPOs.wsf [/Comment:] [/Domain:]

In my environment, I wanted to backup all GPOs to a central location on the file server. What I didn’t want was to retain multiple copies of the GPOs as the likelihood of restoring something that was older than a day is fairly low. My total GPO backup size works out to around 3Gb so a weeks worth of backups works out to over 20Gb. I’ll rely on our file server backups for this.

I created a simple batch file that first deleted the backup folder, then recreated it (ensuring all GPO backups from the previous day were gone), executed the GPO backup script and spit out a simple log file. It looks like this:

rd /s /q “\\[file server]\[backup location]\GPOs\”
mkdir “\\[file server]\[backup location]\GPOs”
cscript “%ProgramFiles(x86)%\Microsoft Group Policy\GPMC Sample Scripts\BackupAllGPOs.wsf” “\\[file server]\[backup location]\GPOs” > \\[file server]\[backup location]\GPOs\GPOBak.log

This seemed to work quite well so the next step was to automate it. Easy-peasy. I created a scheduled task to run the batch file (above) daily at 3:00am.

Restores are probably the easiest part. Simply launch the group policy management tool, right click the domain and choose Manage Backups, enter the UNC path of your backups into the field, choose your backup to restore and hit restore. Done and done.

Hopefully you’re doing this (or something similar) because the alternative sucks and losing something like a GPO can definitely put a downer on the day.