How can I export local Group Policy settings made in gpedit.msc?
Mark Heitbrink, MVP for Group Policy came up with a good solution on how you can “export” the Group Policy and Security settings you made in on a machine with the Local Group Policy Editor (gpedit.msc) to other machines pretty easy:
Normal settings can be copied like this:
1.) Open %systemroot%\system32\grouppolicy\
Within this folder, there are two folders - “machine” and “user”. Copy these to folders to the “%systemroot%\system32\grouppolicy - folder on the target machine. All it needs now is a reboot or a “gpupdate /force”.
Note: If you cannot see the “grouppolicy” folder on either the source or the target machine, be sure to have your explorer folder options set to “Show hidden files and folders”…
For security settings:
1.) Open MMC and add the Snapin “Security Templates”.
2.) Create your own customized template and save it as an “*inf” file.
3.) Copy the file to the target machine and import it via command line tool “secedit”:
secedit /configure /db %temp%\temp.sdb /cfg yourcreated.inf
Further information on secedit can be found here: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/secedit_cmds.mspx?mfr=true
If you’re building custom installations, you can pretty easy script the “overwriting” of the “machine”/”user”-folders or the import via secedit by copying these file to a share and copy and execute them with a script.
How i can export local group policy using windows xp to another computer using windows vista enterprise? Please write step by step. Thanks
It works basically the same way as it did with Windows XP. You copy the contents of the folder %systemroot%\system32\Group Policy to the same folder in Windows Vista. Note that the folder might be hidden so you need to change the Explorer-view.
It would be interesting to know details
[…] Florian’s Blog: How can I export local Group Policy settings made in gpedit.msc? […]
Thanks alot for this info!! Just what I needed!
When I’m setting up computers this is another thing I can automate!! :-)
Is it same for Windows 7?
Yeah, it works the same on Windows 7.
Will it work if you copy the “%systemroot%\system32\grouppolicy” folder from a Windows 2003 32-bit server to a Windows 2003 64-bit server? Can this cause any issues with the 64-bit server?
Howdie!
It should work just the same way. It is just a flat file, no executable or optimized code.
It just works.
Wonderfull, just saved us 2 days of work
I have tried using this for a small network using the logon script on a Samba server, but it isn’t working right. The files are definitely getting copied (I can delete them and they will be replaced), but the settings do not show up in gpedit.msc nor do they get recognized. Is there a cache of the files somewhere?
thank you!!
Ursus,
it should work even with a script. Have you checked the permission(s) on the folder(s)? Also — what settings are you trying to deploy? Note that only settings in “Administrative Templates” are stored in these folders.
Cheers,
Florian
Florian you rock!! Thank you for putting this up here, not only does it give step by step directions for someone like me that’s not the brightest bulb in the fixture, but it gives a great jumping off point for someone that wants to take this further or needs to do more!
My hats off to you, thank you very much!
- Jack
Hi.
a few days ago i was working with the windows policies using the SCM (Security Compliance Manager, it’s a Microsoft’s Tool) and there is an extra tool called “LocalGPO.wsf” so that tool is very useful! i can backup(export), import, and restore to the default configuration like when the windows was installed at the beginning.
The syntax is easy:
to backup (or “export” like they call it)
cscript LocalGPO.wsf /Path:”c:\MyGPOBackups\” /Export /GPOPack and thats it
if you wants to restore that back up just execute the next command:
cscript LocalGPO.wsf /Path:c:\MyGPOBacups\{my_backupped_policy}”
and again thats it
hope to help.
Cheers,
-jimmy
[http://algodecodigo.blogspot.com]