Goatee PFE

Blog of Microsoft Premier Field Engineer Ashley McGlone featuring PowerShell scripts for Active Directory.

Finally! Copy and merge GPOs! PowerShell saves the day!

Finally! Copy and merge GPOs! PowerShell saves the day!

  • Comments 27
  • Likes

The Problem

I wish I had this script five years ago.  At the time I was searching for a way to combine or merge GPOs, but there simply wasn’t a way to do it.  And today there still isn’t a way to do it… until POWERSHELL!  Almost every environment I see (including my own former environment) has a collection of GPOs that have evolved over time and really need to be consolidated and cleaned up.

In Windows Server 2008 R2 we released a new PowerShell module for Group Policy administration.  I haven’t seen much written about it, and I don’t think many people realize it is there.

I’ve been sitting on this script since last September, and ultimately I’d like to convert it to an advanced function.  For now though I wanted to get this code published for the benefit of the community.

 

The Solution

You can use this PowerShell script to copy and merge GPOs.  Yee haw!  Essentially the script does a Get-GPRegistryValue from the source policy and a Set-GPRegistryValue on the destination policy.  It recursively enumerates all settings in the source policy and copies them to the destination policy.  But nothing is ever that simple.  It turns out that there is a special trick to getting and setting a policy value that is in disabled status.  After that hurdle it was smooth sailing.  See the code for the details on this part.

 

Testing It For Yourself

You’ll need to run the script on Windows Server 2008 R2 or Windows 7 with the RSAT for Active Directory and Group Policy Management features installed.  Here are the steps to test it in your environment:

1.       In GPMC create a new GPO called "Starter Computer" based on one of the GPO computer templates.

2.       In GPMC create a new GPO called "Starter User" based on one of the GPO user templates.

3.       Run the script without switches for syntax:  .\copy-gpregistryvalue.ps1

4.       Run the script:  .\copy-gpregistryvalue.ps1 -src "Starter Computer" -dest "Merged GPO" -newDest

5.       Run the script:  .\copy-gpregistryvalue.ps1 -src "Starter User" -dest "Merged GPO"

6.       View the new "Merged GPO" settings in GPMC.

7.       Compare these settings with the ones from the two source GPOs.  They should match everything except the comments (which are unsupported by the current cmdlets).

This demo uses starter policies that separately contain user and computer settings, but you can use it just the same with existing source and destination policies containing both user and computer settings.

 

Limitations

Note that the Get/Set-GPRegistryValue cmdlets do not support the policy comments, therefore these will not be present in the destination GPO.

Also note that due to limitations of the GPO cmdlets we only copy registry-based settings in the policy.  Other settings such as software installations, audit policies, file system permissions, etc. cannot be copied at this time.

Preference are not copied in the current version of the script.  You could easily update the script to call similar cmdlets for Get/Set-GPPrefRegistryValue.  I’ll leave that up to you.

 

Conclusion

Now go clean up all of those policies that need to be consolidated in your environment!  (But first back them up with Backup-GPO.)

 

Resources

TechNet:  Group Policy Cmdlets in Windows PowerShell

 

#--------------------------------------------------------------------            
# Copy GPO Registry Settings            
# Ashley McGlone, Microsoft PFE            
# http://blogs.technet.com/b/ashleymcglone            
# January 2011            
#            
# Parameters:            
#   dom       FQDN of the domain where the GPOs reside            
#   src       string name of the GPO to copy settings from            
#   dest      string name of the GPO to copy settings to            
#   newDest   switch to create dest GPO if it does not exist            
#   copymode  part of GPO to copy: all, user, computer            
#--------------------------------------------------------------------            
            
Param (            
    $dom,            
    $src,            
    $dest,            
    [switch]$newDest,            
    $copymode            
)            
            
# We must continue on errors due to the way we enumerate GPO registry            
# paths and values in the function CopyValues.            
$ErrorActionPreference = "SilentlyContinue"            
$error.PSBase.Clear()            
            
Import-Module ActiveDirectory            
Import-Module GroupPolicy            
            
#--------------------------------------------------------------------            
# Help            
#--------------------------------------------------------------------            
if ($dom -eq $null -and `
    $src -eq $null -and `
    $dest -eq $null -and `
    $copymode -eq $null) {            
    ""            
    "Copy-GPORegistryValue by Ashley McGlone, Microsoft PFE"            
    "For more info: http://blogs.technet.com/b/ashleymcglone"            
    ""            
    "This script copies registry-based GPO settings from one GPO into another."            
    "Use this script to copy and/or merge policy settings."            
    "NOTE: This version does not copy GPO preferences."            
    ""            
    "Syntax:"            
    ".\Copy-GPRegistryValue.ps1 [-dom DomainFQDN] -src `"Source GPO`""            
    "   -dest `"Destination GPO`" [-newDest]"            
    "   [-copymode all/user/computer]"            
    ""            
    "The -dom switch will default to the current domain if blank."            
    "The -copymode will default to all if blank."            
    "The -newDest switch will create a new destination GPO of the specified"            
    "name. If the GPO already exists, then the copy will proceed."            
    ""            
    Return            
}            
            
#--------------------------------------------------------------------            
# Validate parameters            
#--------------------------------------------------------------------            
if ($dom -eq $null) {            
    $dom = (Get-ADDomain).DNSRoot            
} else {            
    $dom = (Get-ADDomain -Identity $dom).DNSRoot            
    If ($error.Count -ne 0) {            
        "Domain name does not exist.  Please specify a valid domain FQDN."            
        $error            
        Return            
    }            
}            
            
if ($src -eq $null) {            
    "Source GPO name cannot be blank."            
    Return            
} else {            
    $src = Get-GPO -Name $src            
    If ($error.Count -ne 0) {            
        "Source GPO does not exist.  Be sure to use quotes around the name."            
        Return            
    }            
}            
            
if ($dest -eq $null) {            
    "Destination GPO name cannot be blank."            
    Return            
} else {            
    if ($newDest -eq $true) {            
        $desttemp = $dest            
        $dest = New-GPO -Name $desttemp            
        If ($error.Count -ne 0) {            
            "The new destination GPO already exists."            
            "Do you want to merge into this GPO (y/n)?"            
            $choice = Read-Host            
            if ($choice -eq "y") {            
                $dest = Get-GPO -Name $desttemp            
            } else {            
                Return            
            }            
        }            
    } else {            
        $dest = Get-GPO -Name $dest            
        If ($error.Count -ne 0) {            
            "Destination GPO does not exist.  Be sure to use quotes around the name."            
            Return            
        }            
    }            
}            
            
if ($copymode -eq $null) {            
    $copymode = "all"            
} else {            
    if ($copymode -ne "all" -and `
        $copymode -ne "user" -and `
        $copymode -ne "computer") {            
        "copymode must be one of the following values:"            
        "all, user, computer"            
        Return            
    }            
}            
#--------------------------------------------------------------------            
            
            
#--------------------------------------------------------------------            
# Echo parameters for this run            
#--------------------------------------------------------------------            
""            
"Domain: $dom"            
"Source GPO: $($src.DisplayName)"            
"Destination GPO: $($dest.DisplayName)"            
"New Destination: $newDest"            
"CopyMode: $copymode"            
""            
#--------------------------------------------------------------------            
            
            
#--------------------------------------------------------------------            
# Copy GPO registry values recursively beginning at a specified root.            
#--------------------------------------------------------------------            
# THIS IS THE HEART OF THE SCRIPT.            
# Essentially this routine does a get from the source and a set on            
# the destination.  Of course nothing is ever that simple, so we have            
# to account for the policystate "delete" which disables a setting;            
# this is like a "negative set".            
# We recurse down each registry path until we find a value to            
# get/set.            
# If we try to get a value from a path (non-leaf level), then we get            
# an error and continue to dig down the path.  If we get a value and            
# no error, then we do the set.            
# User values have a single root: HKCU\Software.            
# Computer values have two roots: HKLM\System & HKLM\Software.            
# You can find these roots yourself by analyzing ADM and ADMX files.            
# It is normal to see an error in the output, because all of these            
# roots are not used in all policies.            
#--------------------------------------------------------------------            
Function CopyValues ($Key) {            
    $Key            
    $error.PSBase.Clear()            
    $path = Get-GPRegistryValue -GUID $src.ID -Key $Key            
    $path            
    If ($error.Count -eq 0) {            
        ForEach ($keypath in $path) {            
            $keypath            
            $keypath | ForEach-Object {Write-Host $_}            
            If ($keypath.HasValue) {            
                $keypath.PolicyState            
                $keypath.Valuename            
                $keypath.Type            
                $keypath.Value            
                If ($keypath.PolicyState -eq "Delete") {   # PolicyState = "Delete"            
                    Set-GPRegistryValue -Disable -Domain $dom -GUID $dest.ID `
                      -Key $keypath.FullKeyPath -ValueName $keypath.Valuename            
                } Else {   # PolicyState = "Set"            
                    $keypath | Set-GPRegistryValue -Domain $dom -GUID $dest.ID            
                }            
            } Else {            
                CopyValues $keypath.FullKeyPath            
            }            
        }            
    } Else {            
        $error            
    }            
}            
#--------------------------------------------------------------------            
            
            
#--------------------------------------------------------------------            
# Call the main copy routine for the specified scope of $copymode            
#--------------------------------------------------------------------            
Function Copy-GPRegistryValue {            
            
    # Copy user settings            
    If (($copymode -eq "user") -or ($copymode -eq "all")) {            
        CopyValues "HKCU\Software"            
        }            
            
    # Copy computer settings            
    If (($copymode -eq "computer") -or ($copymode -eq "all")) {            
        CopyValues "HKLM\System"            
        CopyValues "HKLM\Software"            
        }            
}            
#--------------------------------------------------------------------            
            
# Start the copy            
Copy-GPRegistryValue            
            
#   ><>

 

 

Attachment: Copy-GPRegistryValue.p-s-1.txt

Can you help me?  Yes!

If you would like to have me or another Microsoft PFE visit your company and assist with the ideas presented in this blog post, then contact your Microsoft Premier Technical Account Manager (TAM) for booking information.

For more information about becoming a Microsoft Premier customer email PremSale@microsoft.com.  Tell them GoateePFE sent you.

Sharing Links
Comments
  • 200 proof powershell goodness! Too many GPOs that need to effect all computers but don't have the time to merge them into one? Check out the below link! blogs.technet.com/.../finally-copy-and-merge-gpos-powershell

  • Thx... this is great

  • Great but only limited to registry based settings.

  • tired to merge a large GPO.  Got a call depth error as it reached 1000.  any ideas for workaround?

  • Hi Bobby,

    Congratulations on exploring the depths of PowerShell.  The recursion depth limit is hard-coded in PowerShell v1 and v2.  Although that may change in v3, for now there is no way to change the allowable recursion depth.  I am not aware of any work arounds.

    Exactly how large is the GPO you are trying to merge?

    Ashley

  • The USGCB Windows 7 GPO are the ones that I'm trying to merge into one GPO using this script.  These are in xml format.  Is there a way to merge these using any other process?

    I saw this post where the function could be put in but I'm not a coder and don't know where this would be inserted in the script.

    www.google.com/url

    Thanks,

    Bobby

  • Any ides why this error..I am new to powershell..so sorry guys

    You must provide a value expression on the right-hand side of the '-' operator.

    At line:1 char:32

    + "c:\copy-gpregistryvalue.ps1" - <<<< src "123" -dest "Merged GPO" -newDest

       + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException

       + FullyQualifiedErrorId : ExpectedValueExpression

  • Hi Danny,

    Please post the exact command line you are trying to execute from the PowerShell console.  Please paste it here exactly as you typed it.  Thanks.

    Ashley

  • So when you specify merging the group policy do you mean he target GPO settings are not overwritten but rather the source GPO settings are appended? Will this work for User Rights Assignments?

  • The registry settings in the source GPO will be appended to the target GPO, and anywhere there is a conflict the source GPO settings will overwrite the target.  This does not work for user rights assignment, because that falls outside of the registry settings in the policy.

  • I dream a day when I don't have to roll my own module to do GPPref editing in powershell...scripts like this give me hope.  Keep up the work

  • First of all, thanks for the script - it has given me a reason to start looking at PowerShell after putting it off for a long time!

    I decided to test it out in a test environment using an exported gpo from production, and came across an issue whereby the script gets stuck in an infinite loop if the setting's HasValue property is False, but the PolicyState is Delete. Because the HasValue is false, your script assumes that there must a further subfolder (where there will be a setting) and so calls CopyValues again (and again...). But in fact the setting is at this level, but it is a delete.

    An example of this is the gpo setting:

    [User Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Compatibility View] "Use Policy List of Internet Explorer 7 sites=Disabled"

    I got round this issue by referring to the PolicyState property, rather than HasValue, and performing the actions based on its existence (but do not know if this would have any nasty ramifications?)

    But this then threw up another issue, in that the 'Set-GPRegistryValue -Disable' cmdlet does not seem to amend the destination gpo correctly. This seems to be in all cases where the gpo configuration in registry.pol is "**delvals." as viewable by eg polviewer.

    What happens is that the registry.pol file is updated (seemingly) correctly, and the setting works on applicable clients, and is viewable if editing the gpo directly and opening up the setting, BUT it is NOT visible if looking at the Settings page in GPMC; instead it shows nothing. The only difference that I can see is that using PowerShell, the entry into registry.pol is "**delVals.", whereas editing it manually it comes up as "**delvals." ie with a small v. Is GPMC's reading of registry.pol case-sensistive? Is there anyway round this issue?

    Also, on a side note, the script does not look at gp preferences, although it looks like there are cmdlets to get and set these; will you be updating the script to use these?

    Thanks again

  • Hi I have tried using your script to merge GPO's from my Domain into one. But I recieve the following error each time i try.

    *** Real GPO's replaced with GPO A & Merged GPO ***

    .\MergeGPO_testScript.ps1 -src "GPO A" -dest "Merged GPO" -newDest

    Source GPO does not exist.  Be sure to use quotes around the name.

    I double checked and my GPO's exist in Group Policy.

    Any Ideas?

    Cheers

  • @Mark Flynn,

    Have that one as well...

    @Ashley McGlone

    Have copied the names directly from the GPMC. Listing the group policy using the Get-GPO works fine.

    The syntax I'm using is this:

    .\copy-gpsettings.ps1 -src "NET-GPO-IEsettings" -dest "NET-GPO-IE" -dom ADM.NET.LOCAL

  • Do I need my DC's to be on Windows Server 2008 R2 for these commands to work? as e have Windows Server 2003 DC's.

    I am getting an error when running the following:

    .\copy-gpregistryvalue.ps1 -src "Testing" -dest "Starter Computer"

    I get an error which states:

    Source GPO does not exist.  Be sure to use quotes around the name.

    Which as you can see I have and the GPO does exist on all DC's

    Any thoughts?

    It will be brilliant for our consolodation project we are doing and I will find it really useful if I can use it :)

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment