{"id":17771,"date":"2010-07-13T00:01:00","date_gmt":"2010-07-13T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/07\/13\/hey-scripting-guy-how-can-i-use-group-policy-cmdlets-to-back-up-and-restore-group-policy-objects\/"},"modified":"2010-07-13T00:01:00","modified_gmt":"2010-07-13T00:01:00","slug":"hey-scripting-guy-how-can-i-use-group-policy-cmdlets-to-back-up-and-restore-group-policy-objects","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-how-can-i-use-group-policy-cmdlets-to-back-up-and-restore-group-policy-objects\/","title":{"rendered":"Hey, Scripting Guy! How Can I Use Group Policy Cmdlets to Back Up and Restore Group Policy Objects?"},"content":{"rendered":"

 \n\"Hey,\nHey, Scripting Guy! I want to know how to use the Group Policy cmdlets in Windows PowerShell<\/a> to back up and to restore Group Policy<\/a> objects (GPOs), and I have heard that there are Group Policy cmdlets in Windows 7<\/a>. Can you help me?\n— GJ\n \n\"Hey,<\/p>\n

Hello GJ, <\/p>\n

Microsoft Scripting Guy Ed Wilson here. It is hot and humid in Charlotte. The humidity hangs in the air like a heavy quilt on a hot summer night, draping everything exposed to the environment with a seemingly endless supply of moisture. The weeds are happy and thrive in the conditions. They appear to draw their needed nutrients from the thick syrupy air. The grasshoppers love the weather; I guess the dense air gives them more lift as they hop about the dark and dusty lawns. Most other living creatures seek respite in highly coveted shady spots away from the humidity. The humidity is nearly sentient, and it seems to seek its victims with malevolent intent. It invades homes through doors carelessly left standing wide, seeping under half-closed windows and oozing through cracks in chinking and insulation. <\/p>\n

<\/span><\/p>\n

If carbon-based life forms do not care for humidity, personal computers have a particular disdain for its effects on motherboards and other electronic components comprising their insides. Oh, the joys of life in the deep south! I have not resorted to drinking iced tea, but I can see why one might be tempted to do so. A tall glass of cool spring water wrapped in a napkin to absorb the moisture from the glass and freshened up with a sprig of fresh plucked mint is my personal ticket to happiness. I have also found that a single ANZAC biscuit is a great accompaniment to the water when it is nibbled with mouselike bites. It makes no sense to complain about the weather. Instead, I come to terms with it. <\/p>\n

<\/span><\/p>\n

<\/p>\n

 <\/p>\n

<\/span><\/p>\n

GJ, the first thing you need to do when working with the Group Policy cmdlets is to import the GroupPolicy<\/strong> module. This assumes you have installed the appropriate package or enabled the appropriate feature. For more information about gaining access to the Group Policy cmdlets, see yesterday’s Hey, Scripting Guy! post<\/a>.<\/p>\n

<\/span><\/p>\n

The Import-Module<\/strong> cmdlet displays no feedback if the GroupPolicy<\/strong> module loads properly. The code shown here illustrates this:<\/p>\n

<\/span><\/p>\n

PS C:> Import-Module -Name grouppolicy
PS C:><\/p>\n

<\/span><\/span><\/p>\n

By using the Get-Command<\/strong> cmdlet, you can ensure that the GroupPolicy<\/strong> module loaded properly. In addition, the command displays the cmdlets you will be able to access. The command and attendant output listed here shows the results:<\/p>\n

<\/span><\/p>\n

PS C:> Get-Command -Module grouppolicy<\/p>\n

CommandType     <\/span>Name                               <\/span>Definition
———–         <\/span>—-                                 <\/span>———-
Cmdlet              <\/span>Backup-GPO                         <\/span>Backup-GPO -Guid <Guid> -Path …
Cmdlet              <\/span>Copy-GPO                            <\/span>Copy-GPO -SourceGuid <Guid> -T…
Cmdlet              <\/span>Get-GPInheritance                 <\/span>Get-GPInheritance [-Target] <S…
Cmdlet              <\/span>Get-GPO                              <\/span>Get-GPO [-Guid] <Guid> [[-Doma…
Cmdlet              <\/span>Get-GPOReport                    <\/span>Get-GPOReport [-Guid] <Guid> […
Cmdlet              <\/span>Get-GPPermissions               <\/span>Get-GPPermissions -Guid <Guid>…
Cmdlet              <\/span>Get-GPPrefRegistryValue       <\/span>Get-GPPrefRegistryValue -Guid …
Cmdlet              <\/span>Get-GPRegistryValue             <\/span>Get-GPRegistryValue -Guid <Gui…
Cmdlet              <\/span>Get-GPResultantSetOfPolicy   <\/span>Get-GPResultantSetOfPolicy [-C…
Cmdlet              <\/span>Get-GPStarterGPO                 <\/span>Get-GPStarterGPO -Guid <Guid> …
Cmdlet              <\/span>Import-GPO                            <\/span>Import-GPO -BackupId <Guid> -P…
Cmdlet              <\/span>New-GPLink                           <\/span>New-GPLink -Guid <Guid> -Targe…
Cmdlet              <\/span>New-GPO                          &nbsp\n;    <\/span>New-GPO [-Name] <String> [-Com…
Cmdlet              <\/span>New-GPStarterGPO                <\/span>New-GPStarterGPO [-Name] <Stri…
Cmdlet              <\/span>Remove-GPLink                      <\/span>Remove-GPLink -Guid <Guid> -Ta…
Cmdlet              <\/span>Remove-GPO                          <\/span>Remove-GPO -Guid <Guid> [-Doma…
Cmdlet              <\/span>Remove-GPPrefRegistryValue   <\/span>Remove-GPPrefRegistryValue [[-…
Cmdlet              <\/span>Remove-GPRegistryValue         <\/span>Remove-GPRegistryValue [-Guid]…
Cmdlet              <\/span>Rename-GPO                          <\/span>Rename-GPO -Guid <Guid> -Targe…
Cmdlet              <\/span>Restore-GPO                           <\/span>Restore-GPO -BackupId <Guid> -…
Cmdlet              <\/span>Set-GPInheritance                    <\/span>Set-GPInheritance [-Target] <S…
Cmdlet              <\/span>Set-GPLink                              <\/span>Set-GPLink -Guid <Guid> -Targe…
Cmdlet              <\/span>Set-GPPermissions                  <\/span>Set-GPPermissions -Guid <Guid>…
Cmdlet              <\/span>Set-GPPrefRegistryValue          <\/span>Set-GPPrefRegistryValue -Guid …
Cmdlet              <\/span>Set-GPRegistryValue               <\/span>Set-GPRegistryValue -Guid <Gui…<\/span><\/p>\n

PS C:><\/p>\n

<\/span><\/p>\n

A better, more informative display of Windows PowerShell cmdlets can be obtained by piping the results of the Get-Command<\/strong> cmdlet to the Get-Help<\/strong> cmdlet and finally to the Format-Table<\/strong> cmdlet. By choosing the name of the cmdlet and the description of the cmdlet, a nice table is produced. The resulting command is shown here:<\/p>\n

<\/span><\/p>\n

Get-Command -Module grouppolicy | Get-Help | Format-Table name, synopsis -AutoSize -Wrap<\/p>\n

<\/span><\/span><\/p>\n

The –wrap<\/strong> parameter wraps the text in the Windows PowerShell console as shown in the following image. <\/p>\n

<\/span><\/p>\n

<\/p>\n

<\/span><\/p>\n

<\/p>\n

\"Image <\/p>\n

<\/span><\/p>\n

The display of the complete output of the previous command is shown here: <\/p>\n

<\/span><\/p>\n

PS C:> Get-Command -Module grouppolicy | get-help | Format-Table name, synopsis -Aut
oSize -Wrap<\/p>\n

Name                       <\/span>Synopsis
—-                         <\/span>——–
Backup-GPO               <\/span>Backs up one GPO or all the GPOs in a domain.
Copy-GPO                 <\/span>Copies a GPO.
Get-GPInheritance       <\/span>Retrieves Group Policy inheritance information for a specified domain or OU.
Get-GPO                    <\/span>Gets one GPO or all the GPOs in a domain.
Get-GPOReport              <\/span>Generates a report either in XML or HTML format for a specified GPO or for
                                   all GPOs in a domain.
Get-GPPermissions          <\/span>Gets the permission level for one or more security principals on a specified GPO.
Get-GPPrefRegistryValue    <\/span>Retrieves one or more Registry preference items under either Computer
 &nb\nsp;                                 Configuration or User Configuration in a GPO.
Get-GPRegistryValue        <\/span>Retrieves one or more registry-based policy settings under either Computer
                                   Configuration or User Configuration in a GPO.
Get-GPResultantSetofPolicy Outputs the Resultant Set of Policy (RSoP) information for a user, a computer,
                                  or both to a file.
Get-GPStarterGPO           <\/span>Gets one Starter GPO or all Starter GPOs in a domain.
Import-GPO                 <\/span>Imports the Group Policy settings from a backed-up GPO into a specified GPO.
New-GPLink                 <\/span>Links a GPO to a site, domain, or organizational unit (OU).
New-GPO                    <\/span>Creates a new GPO.
New-GPStarterGPO           <\/span>Creates a new Starter GPO.
Remove-GPLink              <\/span>Removes a GPO link from a site, domain or OU.
Remove-GPO                 <\/span>Deletes a GPO.
Remove-GPPrefRegistryValue Removes one or more Registry preference items from either Computer
                                   Configuration or User Configuration in a GPO.
Remove-GPRegistryValue     <\/span>Removes one or more registry-based policy settings from either Computer 
                                   Configuration or User Configuration in a GPO.
Rename-GPO                 <\/span>Assigns a new display name to a GPO.
Restore-GPO                <\/span>Restores one GPO or all GPOs in a domain from one or more GPO backup files.
Set-GPInheritance          <\/span>Blocks or unblocks inheritance for a specified domain or organizational unit (OU).
Set-GPLink                 <\/span>Sets the properties of the specified GPO link.
Set-GPPermissions          <\/span>Grants a level of permissions to a security principal for one GPO or all the GPOs in a domain.
Set-GPPrefRegistryValue    <\/span>Configures a Registry preference item under either Computer Configuration or
                                    User Configuration in a GPO.
Set-GPRegistryValue        <\/span>Configures one or more registry-based policy settings under either Computer 
                                    Configuration or User Configuration in a GPO.<\/p>\n

PS C:><\/span><\/span><\/p>\n

<\/p>\n

<\/span><\/span><\/p>\n

To create a backup copy of all the GPOs in the domain, use the Backup-GPO<\/strong> cmdlet. When using this cmdlet, I prefer to target a specific domain controller and a specific domain. The destination for the backup can be a local location or a UNC path. The Backup-GPO<\/strong> cmdlet returns an instance of the Microsoft.GroupPolicy.GPOBackUp<\/strong> .NET Framework class and each instance of the class returns to the Windows PowerShell console. The output from the backup of all GPOs in the NWTraders.com domain command is shown here:<\/p>\n

<\/span><\/p>\n

PS C:> Backup-GPO -All -Path \\hyperv-boxbackups -Comment “weekly Backup” -Domain n
wtraders.com -Server dc1<\/p>\n

DisplayName     <\/span>: Default Domain Policy
GpoId           <\/span>: 31b2f340-016d-11d2-945f-00c04fb984f9
Id              <\/span>: ad374f52-45ab-47dd-9594-1bfd063c03e3
BackupDirectory : \\hyperv-boxbackups
CreationTime    <\/span>: 7\/8\/2010 12:47:34 PM
DomainName      <\/span>: nwtraders.com
Comment         <\/span>: weekly Backup<\/p>\n

DisplayName     <\/span>: TrustedHosts
GpoId           <\/span>: 453d3237-0e74-4aac-a675-ddf2c8aeed4b
Id              <\/span>: dd2ed13b-9b87-4f09-abaa-f3cc33285e1d
BackupDirectory : \\hyperv-boxbackups
CreationTime    <\/span>: 7\/8\/2010 12:47:39 PM
DomainName      <\/span>: nwtraders.com
Comment         <\/span>: weekly Backup<\/p>\n

DisplayName     <\/span>: Default Domain Controllers Policy
GpoId   <\/span>        <\/span>: 6ac1786c-016f-11d2-945f-00c04fb984f9
Id              <\/span>: accabff4-1113-452e-b8a6-ee5aa13047ed
BackupDirectory : \\hyperv-boxbackups
CreationTime    <\/span>: 7\/8\/2010 12:47:39 PM
DomainName      <\/span>: nwtraders.com
Comment         <\/span>: weekly Backup<\/span><\/span><\/p>\n

<\/p>\n

<\/span><\/span><\/p>\n

The backup of each GPO is stored in a dynamically generated folder with an associated GUID. This is shown in the following image.<\/p>\n

<\/span><\/p>\n

<\/p>\n

<\/span><\/p>\n

<\/p>\n

 \"Image<\/p>\n

<\/span><\/p>\n

A manifest in the root of the backup folder points to each backup. The manifest is seen in XML Notepad in the following image.<\/p>\n

<\/span><\/p>\n

<\/p>\n

<\/span><\/p>\n

<\/p>\n

 \"Image<\/p>\n

<\/span><\/p>\n

To restore a GPO, use the Restore-GPO<\/strong> cmdlet. You can select a specific GPO backup if you need to, or use the defaults that will restore the most recent backup. This is shown here:<\/p>\n

<\/span><\/p>\n

PS C:> Restore-GPO -All -Domain nwtraders.com -path \\hyperv-boxbackups<\/p>\n

DisplayName      <\/span>: Default Domain Policy
DomainName       <\/span>: nwtraders.com
Owner            <\/span>: NWTRADERSDomain Admins
Id               <\/span>: 31b2f340-016d-11d2-945f-00c04fb984f9
GpoStatus        <\/span>: AllSettingsEnabled
Description      <\/span>:
CreationTime     <\/span>: 9\/8\/2009 5:50:46 PM
ModificationTime : 7\/8\/2010 2:30:20 PM
UserVersion      <\/span>: AD Version: 1, SysVol Version: 1
ComputerVersion  <\/span>: AD Version: 26, SysVol Version: 26
WmiFilter        <\/span>:<\/p>\n

DisplayName      <\/span>: TrustedHosts
DomainName       <\/span>: nwtraders.com
Owner            <\/span>: NWTRADERSDomain Admins
Id               <\/span>: 453d3237-0e74-4aac-a675-ddf2c8aeed4b
GpoStatus        <\/span>: AllSettingsEnabled
Description      <\/span>:
CreationTime     <\/span>: 5\/3\/2010 11:58:05 AM
ModificationTime : 7\/8\/2010 2:30:22 PM
UserVersion      <\/span>: AD Version: 1, SysVol Version: 1
ComputerVersion  <\/span>: AD Version: 2, SysVol Version: 2
WmiFilter        <\/span>:<\/p>\n

DisplayName      <\/span>: Default Domain Controllers Policy
DomainName       <\/span>: nwtraders.com
Owner            <\/span>: NWTRADERSDomain Admins
Id         <\/span>      <\/span>: 6ac1786c-016f-11d2-945f-00c04fb984f9
GpoStatus        <\/span>: AllSettingsEnabled
Description      <\/span>:
CreationTime     <\/span>: 9\/8\/2009 5:50:46 PM
ModificationTime : 7\/8\/2010 2:30:23 PM
UserVersion      <\/span>: AD Version: 1, SysVol Version: 1
ComputerVersion  <\/span>: AD Version: 9, SysVol Version: 9
WmiFilter        <\/span>:<\/p>\n

PS C:><\/span><\/p>\n

<\/span><\/p>\n

<\/p>\n

<\/span><\/p>\n


GJ, that is all there is to using Group Policy cmdlets to backup and restore GPOs. Group Policy Week will continue tomorrow when we will talk about checking for replication. <\/p>\n

<\/span><\/p>\n

We invite you to follow us on Twitter<\/span><\/span><\/a> or <\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

  Hey, Scripting Guy! I want to know how to use the Group Policy cmdlets in Windows PowerShell to back up and to restore Group Policy objects (GPOs), and I have heard that there are Group Policy cmdlets in Windows 7. Can you help me? — GJ   Hello GJ, Microsoft Scripting Guy Ed Wilson […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[152,3,45],"class_list":["post-17771","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-group-policy","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":"

  Hey, Scripting Guy! I want to know how to use the Group Policy cmdlets in Windows PowerShell to back up and to restore Group Policy objects (GPOs), and I have heard that there are Group Policy cmdlets in Windows 7. Can you help me? — GJ   Hello GJ, Microsoft Scripting Guy Ed Wilson […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17771","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=17771"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17771\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=17771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=17771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=17771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}