How can I export local Group Policy settings made in gpedit.msc?

Mark Heitbrink, MVP for Group Policy came up with a good solution on how you can “export” the Group Policy and Security settings you made in on a machine with the Local Group Policy Editor (gpedit.msc) to other machines pretty easy:

Normal settings can be copied like this:

1.) Open %systemroot%\system32\grouppolicy\

Within this folder, there are two folders - “machine” and “user”. Copy these to folders to the “%systemroot%\system32\grouppolicy - folder on the target machine. All it needs now is a reboot or a “gpupdate /force”.

Note: If you cannot see the “grouppolicy” folder on either the source or the target machine, be sure to have your explorer folder options set to “Show hidden files and folders”…

For security settings:

1.) Open MMC and add the Snapin “Security Templates”.

2.) Create your own customized template and save it as an “*inf” file.

3.) Copy the file to the target machine and import it via command line tool “secedit”:

secedit /configure /db %temp%\temp.sdb /cfg yourcreated.inf

Further information on secedit can be found here: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/secedit_cmds.mspx?mfr=true

If you’re building custom installations, you can pretty easy script the “overwriting” of the “machine”/”user”-folders or the import via secedit by copying these file to a share and copy and execute them with a script.

15 Comments so far

  1. Ricardo Gaspar on September 8th, 2008

    How i can export local group policy using windows xp to another computer using windows vista enterprise? Please write step by step. Thanks

  2. florian on September 16th, 2008

    It works basically the same way as it did with Windows XP. You copy the contents of the folder %systemroot%\system32\Group Policy to the same folder in Windows Vista. Note that the folder might be hidden so you need to change the Explorer-view.

  3. Love on November 6th, 2008

    It would be interesting to know details

  4. […] Florian’s Blog: How can I export local Group Policy settings made in gpedit.msc? […]

  5. Thankful on March 27th, 2010

    Thanks alot for this info!! Just what I needed!
    When I’m setting up computers this is another thing I can automate!! :-)

  6. MT on April 5th, 2010

    Is it same for Windows 7?

  7. florian on April 5th, 2010

    Yeah, it works the same on Windows 7.

  8. beholder on July 30th, 2010

    Will it work if you copy the “%systemroot%\system32\grouppolicy” folder from a Windows 2003 32-bit server to a Windows 2003 64-bit server? Can this cause any issues with the 64-bit server?

  9. florian on August 2nd, 2010

    Howdie!

    It should work just the same way. It is just a flat file, no executable or optimized code.
    It just works.

  10. Erik on November 23rd, 2010

    Wonderfull, just saved us 2 days of work

  11. Ursus on November 30th, 2010

    I have tried using this for a small network using the logon script on a Samba server, but it isn’t working right. The files are definitely getting copied (I can delete them and they will be replaced), but the settings do not show up in gpedit.msc nor do they get recognized. Is there a cache of the files somewhere?

  12. thanh on December 5th, 2010

    thank you!!

  13. florian on January 2nd, 2011

    Ursus,

    it should work even with a script. Have you checked the permission(s) on the folder(s)? Also — what settings are you trying to deploy? Note that only settings in “Administrative Templates” are stored in these folders.

    Cheers,
    Florian

  14. Jack Flack on July 19th, 2012

    Florian you rock!! Thank you for putting this up here, not only does it give step by step directions for someone like me that’s not the brightest bulb in the fixture, but it gives a great jumping off point for someone that wants to take this further or needs to do more!

    My hats off to you, thank you very much!

    - Jack

  15. jimmy on February 20th, 2013

    Hi.
    a few days ago i was working with the windows policies using the SCM (Security Compliance Manager, it’s a Microsoft’s Tool) and there is an extra tool called “LocalGPO.wsf” so that tool is very useful! i can backup(export), import, and restore to the default configuration like when the windows was installed at the beginning.
    The syntax is easy:

    to backup (or “export” like they call it)
    cscript LocalGPO.wsf /Path:”c:\MyGPOBackups\” /Export /GPOPack and thats it
    if you wants to restore that back up just execute the next command:

    cscript LocalGPO.wsf /Path:c:\MyGPOBacups\{my_backupped_policy}”

    and again thats it

    hope to help.

    Cheers,

    -jimmy
    [http://algodecodigo.blogspot.com]