Import Group Policy from one Domain to another Domain


Scenario:

We have multi forest domain in our organization that means each location have separate single forest domain, but all are under single management umbrella.

Recently there is one recommendation from Security Team to implement several settings of IE, Control Panel, Intranet, System, Network etc. & I found its count is almost 200. When I tried to create a Group Policy Object (GPO) for this, it took almost 7 hrs.

 

Challenges:

Apply the same policy setting for other domains is a tedious job, only way out to import the GPO to other domains. But importing GPO to other domain (different forest) can’t be straight way – it can be possible with help of GPO backup & import the backup to other domain.

 

Procedure:

1.    After configure all the settings in GPO in our DC (i.e. Blue.COM), take the backup of GPO.


PIX-01: Backup of GPO

2.    Copy the backup into the Domain Controller (i.e. Black.COM) where you want to import the GPO.

3.    Create a folder (i.e. backup) on the Black.COM Domain Controller.

4.    Create a GPO under Group Policy Objects in Black.COM (i.e. GPO_New Audit Policy).

5.    Select “GPO_New Audit policy” > Import settings > Next > Click on “Backup” tab > Browse the path for backup, point to “Backup” folder, which is created just before.

Pix-02:Importing GPO: 01

 6.    Click on “Backup” tab > OK > Next > Now select the backup location, from which you want to import settings > Browse the path to the “Backup-GPO”, where GPO from Blue.COM is saved > Next > Show the GPO which you want to import >Next >Next > Finish > OK.

Pix-03:Importing GPO: 02

7.    Now policy from Blue.COM is now imported into Black.COM.

Pix-04: Successfully Import GPO


Pix-05: Imported GPO in Black.COM

Comments

Post a Comment

Thank you.

Popular posts from this blog

Google Chrome Bookmark & Homepage through GPO

Image
Goals: We need to create a GPO for Google Chrome Bookmarks & home page/landing page. Under the bookmarks, few URLs would be there. It will be easy for users to access these url/site. Also by home page – most useful/frequently open site can be set, so that when user open Google chrome, the page will be displayed first. Gyan: All policy setting for Group Policy Management Console are not readily available. Sometime to manipulate group policy settings for higher version OS (i.e. Screensaver for Windows 10) or third party application (i.e. Google Chrome),we need to download group policy setting supported files – admx (policy settings) along with adml (language suppot). Both files are stored into central storage repository, known as “ Central Store ”. For higher Windows it is “ PolicyDefinitions” – automaticall created when a DC built under C:\Windows\ Process: Incorporate Chrome GPO templates:         1.       To manage Chrome settings through Group Policies, you
Read more

DNS Server IP Address change in Client Systems through Group Policy

Image
  Scenario: Recently our network team, restructure IP segments & it is recommended to change the IP address of our DNS server. It is an AD integrated DNS server & around 1000 desktops & laptops are in the network – all have static IP addresses. We need to change the DNS IP for all the systems. Procedure: We can change the DNS IP through Group Policy with the help of a simple *.bat file. We will apply the GPO in Startup as Computer base policy. But here tricky part is, we need run the batch file in "Run as Administrator" mode. Most of the Computer-based Startup GPO is not run in normal mode. The batch file as below, suppose it name DNSIP_Change.bat   :   Replace your DNS Server “ set dnsserver=X.X.X.X ” @echo off set dnsserver=10.10.10.31 set dnsserver2=10.10.10.30 for /f "tokens=1,2,3*" %%i in ('netsh interface show interface') do (   if %%i EQU Enabled (   rem echo change "%%l" : %dnsserver%   netsh interface
Read more

File Server Migration: Windows Server 2008R2 to Windows Server 2019

Image
  Scenario:   We have a File Server on Windows Server 2008R2 . The File Server has several departmental shares & it is accessed by the department user only. But among them few have RW (Read & Write) permission, rest have only R (Read) permission. Also every dept. share have disk quota & every authorized user has their shared folder mapped as a network drive in their Windows Explorer. In my environment, I have implemented the procedure for 15 different departmental share folders accessing different departments consist of 10-30 users each dept & each shared folder volume is 100 GB to 500GB. Challenges: 1 .       Migrated Share Folders must have the same level of permission as on W2008 Server. 2.        Several Disk quota templates need to export to new W2019 to minimized the effort.   Users should be transparent to this migration & their access to the shared folder must be flowless – that meant users
Read more