A best practice in domain environments are backing up the Group Policy Objects regularly. Even though a GPO may be restored by restoring a system state backup from a domain controller to an alternate location, and then copy the contents from the deleted GPO to a new GPO to restore the settings, this may be a hazzle since it
s not pretty straightforward. It also requires you to restart the domain controller affected in Directory Services Restore Mode.
PowerShell MVP Don Jones has written a good article on this topic, available here.
For those of you who may not want to do GPO restore the hard way, or buy a commercial third party product, I would encourage you to schedule regular GPO backups using the Windows PowerShell Group Policy-module available in Windows Server 2008 R2, as well as RSAT in Windows 7.
To accomplish this, Ive written a small script which backs up all modified GPO`s in the specified timespan. I would generally recommend to have the script run once a day, thereby setting the timespan-variable to the last 24 hours. The script are called Backup-ModifiedGPOs.ps1, and available from here.
All Group Policy Objects modified in the specified timespan are backup up to the specified backup path.
Also, an HTML-report are created for each GPO-backup, with the unique backup GUID as part of the filename. This way you can easily see what settings each backup contains.
When restoring a GPO, you must first note the GUID of the backup you want to restore. Then you can restore the GPO by using the Restore-GPO cmdlet in the Group Policy-module. Sample usage:
Administrators who feels more comfortable working with the GUI, may use the Group Policy Management Console to do the restore.
The following procedure from the Group Policy Planning and Deployment Guide on Microsoft TechNet describes how to accomplish the restore operation from the GUI:
To view the list of GPO backups
- In the GPMC console tree, expand the forest or domain that contains the GPOs that you want to back up.
- Right-click Group Policy Objects, and the click Manage Backups.
- In the Manage Backups dialog box, enter the path to the location where you stored the GPO backups that you want to view. Alternatively, you can click Browse, locate the folder that contains the GPO backups, and then click OK.
- To specify that only the most recent version of the GPOs be displayed in the Backed up GPOs list, select the Show only the latest version of each GPO check box. Click Close.
Using the GPMC to restore GPOs
You can also restore GPOs. This operation restores a backed-up GPO to the same domain from which it was backed up. You cannot restore a GPO from a backup into a domain that is different from the GPO’s original domain.
To restore a previous version of an existing GPO
- In the GPMC console tree, expand Group Policy Objects in the forest or domain that contains the GPOs that you want to restore.
- Right-click the GPO that you want to restore to a previous version, and then click Restore from Backup.
- When the Restore Group Policy Object Wizard opens, follow the instructions in the wizard, and then click Finish.
- After the restore operation completes, a summary will state whether the restore succeeded. Click OK.
To restore a deleted GPO
- In the GPMC console tree, expand the forest or domain that contains the GPO that you want to restore.
- Right-click Group Policy Objects, and then click Manage Backups.
- In the Manage Backups dialog box, click Browse, and then locate the file that contains your backed-up GPOs.
- In the Backed up GPOs list, click the GPO that you want to restore, and then click Restore.
- When you are prompted to confirm the restore operation, click OK.
- After the restore operation completes, a summary will state whether the restore succeeded. Click OK. Click Close.
Important: Since Group Policy links are stored on the Organizational Unit objects in Active Directory, this information are not backup up and also not restore. However, the HTML backup-reports contains this information, so you may manually re-link the GPO to the correct OU(s).
Also note that WMI filters and IPSec policies are not backed up by the backup feature in the Group Policy Management Console. For more information on how to manage these items, see the before mentioned Group Policy Planning and Deployment Guide.