Goatee PFE

Blog of Microsoft Premier Field Engineer Ashley McGlone featuring PowerShell scripts for Active Directory.

Finally! Copy and merge GPOs! PowerShell saves the day!

Finally! Copy and merge GPOs! PowerShell saves the day!

  • Comments 27
  • Likes

The Problem

I wish I had this script five years ago.  At the time I was searching for a way to combine or merge GPOs, but there simply wasn’t a way to do it.  And today there still isn’t a way to do it… until POWERSHELL!  Almost every environment I see (including my own former environment) has a collection of GPOs that have evolved over time and really need to be consolidated and cleaned up.

In Windows Server 2008 R2 we released a new PowerShell module for Group Policy administration.  I haven’t seen much written about it, and I don’t think many people realize it is there.

I’ve been sitting on this script since last September, and ultimately I’d like to convert it to an advanced function.  For now though I wanted to get this code published for the benefit of the community.

 

The Solution

You can use this PowerShell script to copy and merge GPOs.  Yee haw!  Essentially the script does a Get-GPRegistryValue from the source policy and a Set-GPRegistryValue on the destination policy.  It recursively enumerates all settings in the source policy and copies them to the destination policy.  But nothing is ever that simple.  It turns out that there is a special trick to getting and setting a policy value that is in disabled status.  After that hurdle it was smooth sailing.  See the code for the details on this part.

 

Testing It For Yourself

You’ll need to run the script on Windows Server 2008 R2 or Windows 7 with the RSAT for Active Directory and Group Policy Management features installed.  Here are the steps to test it in your environment:

1.       In GPMC create a new GPO called "Starter Computer" based on one of the GPO computer templates.

2.       In GPMC create a new GPO called "Starter User" based on one of the GPO user templates.

3.       Run the script without switches for syntax:  .\copy-gpregistryvalue.ps1

4.       Run the script:  .\copy-gpregistryvalue.ps1 -src "Starter Computer" -dest "Merged GPO" -newDest

5.       Run the script:  .\copy-gpregistryvalue.ps1 -src "Starter User" -dest "Merged GPO"

6.       View the new "Merged GPO" settings in GPMC.

7.       Compare these settings with the ones from the two source GPOs.  They should match everything except the comments (which are unsupported by the current cmdlets).

This demo uses starter policies that separately contain user and computer settings, but you can use it just the same with existing source and destination policies containing both user and computer settings.

 

Limitations

Note that the Get/Set-GPRegistryValue cmdlets do not support the policy comments, therefore these will not be present in the destination GPO.

Also note that due to limitations of the GPO cmdlets we only copy registry-based settings in the policy.  Other settings such as software installations, audit policies, file system permissions, etc. cannot be copied at this time.

Preference are not copied in the current version of the script.  You could easily update the script to call similar cmdlets for Get/Set-GPPrefRegistryValue.  I’ll leave that up to you.

 

Conclusion

Now go clean up all of those policies that need to be consolidated in your environment!  (But first back them up with Backup-GPO.)

 

Resources

TechNet:  Group Policy Cmdlets in Windows PowerShell

 

#--------------------------------------------------------------------            
# Copy GPO Registry Settings            
# Ashley McGlone, Microsoft PFE            
# http://blogs.technet.com/b/ashleymcglone            
# January 2011            
#            
# Parameters:            
#   dom       FQDN of the domain where the GPOs reside            
#   src       string name of the GPO to copy settings from            
#   dest      string name of the GPO to copy settings to            
#   newDest   switch to create dest GPO if it does not exist            
#   copymode  part of GPO to copy: all, user, computer            
#--------------------------------------------------------------------            
            
Param (            
    $dom,            
    $src,            
    $dest,            
    [switch]$newDest,            
    $copymode            
)            
            
# We must continue on errors due to the way we enumerate GPO registry            
# paths and values in the function CopyValues.            
$ErrorActionPreference = "SilentlyContinue"            
$error.PSBase.Clear()            
            
Import-Module ActiveDirectory            
Import-Module GroupPolicy            
            
#--------------------------------------------------------------------            
# Help            
#--------------------------------------------------------------------            
if ($dom -eq $null -and `
    $src -eq $null -and `
    $dest -eq $null -and `
    $copymode -eq $null) {            
    ""            
    "Copy-GPORegistryValue by Ashley McGlone, Microsoft PFE"            
    "For more info: http://blogs.technet.com/b/ashleymcglone"            
    ""            
    "This script copies registry-based GPO settings from one GPO into another."            
    "Use this script to copy and/or merge policy settings."            
    "NOTE: This version does not copy GPO preferences."            
    ""            
    "Syntax:"            
    ".\Copy-GPRegistryValue.ps1 [-dom DomainFQDN] -src `"Source GPO`""            
    "   -dest `"Destination GPO`" [-newDest]"            
    "   [-copymode all/user/computer]"            
    ""            
    "The -dom switch will default to the current domain if blank."            
    "The -copymode will default to all if blank."            
    "The -newDest switch will create a new destination GPO of the specified"            
    "name. If the GPO already exists, then the copy will proceed."            
    ""            
    Return            
}            
            
#--------------------------------------------------------------------            
# Validate parameters            
#--------------------------------------------------------------------            
if ($dom -eq $null) {            
    $dom = (Get-ADDomain).DNSRoot            
} else {            
    $dom = (Get-ADDomain -Identity $dom).DNSRoot            
    If ($error.Count -ne 0) {            
        "Domain name does not exist.  Please specify a valid domain FQDN."            
        $error            
        Return            
    }            
}            
            
if ($src -eq $null) {            
    "Source GPO name cannot be blank."            
    Return            
} else {            
    $src = Get-GPO -Name $src            
    If ($error.Count -ne 0) {            
        "Source GPO does not exist.  Be sure to use quotes around the name."            
        Return            
    }            
}            
            
if ($dest -eq $null) {            
    "Destination GPO name cannot be blank."            
    Return            
} else {            
    if ($newDest -eq $true) {            
        $desttemp = $dest            
        $dest = New-GPO -Name $desttemp            
        If ($error.Count -ne 0) {            
            "The new destination GPO already exists."            
            "Do you want to merge into this GPO (y/n)?"            
            $choice = Read-Host            
            if ($choice -eq "y") {            
                $dest = Get-GPO -Name $desttemp            
            } else {            
                Return            
            }            
        }            
    } else {            
        $dest = Get-GPO -Name $dest            
        If ($error.Count -ne 0) {            
            "Destination GPO does not exist.  Be sure to use quotes around the name."            
            Return            
        }            
    }            
}            
            
if ($copymode -eq $null) {            
    $copymode = "all"            
} else {            
    if ($copymode -ne "all" -and `
        $copymode -ne "user" -and `
        $copymode -ne "computer") {            
        "copymode must be one of the following values:"            
        "all, user, computer"            
        Return            
    }            
}            
#--------------------------------------------------------------------            
            
            
#--------------------------------------------------------------------            
# Echo parameters for this run            
#--------------------------------------------------------------------            
""            
"Domain: $dom"            
"Source GPO: $($src.DisplayName)"            
"Destination GPO: $($dest.DisplayName)"            
"New Destination: $newDest"            
"CopyMode: $copymode"            
""            
#--------------------------------------------------------------------            
            
            
#--------------------------------------------------------------------            
# Copy GPO registry values recursively beginning at a specified root.            
#--------------------------------------------------------------------            
# THIS IS THE HEART OF THE SCRIPT.            
# Essentially this routine does a get from the source and a set on            
# the destination.  Of course nothing is ever that simple, so we have            
# to account for the policystate "delete" which disables a setting;            
# this is like a "negative set".            
# We recurse down each registry path until we find a value to            
# get/set.            
# If we try to get a value from a path (non-leaf level), then we get            
# an error and continue to dig down the path.  If we get a value and            
# no error, then we do the set.            
# User values have a single root: HKCU\Software.            
# Computer values have two roots: HKLM\System & HKLM\Software.            
# You can find these roots yourself by analyzing ADM and ADMX files.            
# It is normal to see an error in the output, because all of these            
# roots are not used in all policies.            
#--------------------------------------------------------------------            
Function CopyValues ($Key) {            
    $Key            
    $error.PSBase.Clear()            
    $path = Get-GPRegistryValue -GUID $src.ID -Key $Key            
    $path            
    If ($error.Count -eq 0) {            
        ForEach ($keypath in $path) {            
            $keypath            
            $keypath | ForEach-Object {Write-Host $_}            
            If ($keypath.HasValue) {            
                $keypath.PolicyState            
                $keypath.Valuename            
                $keypath.Type            
                $keypath.Value            
                If ($keypath.PolicyState -eq "Delete") {   # PolicyState = "Delete"            
                    Set-GPRegistryValue -Disable -Domain $dom -GUID $dest.ID `
                      -Key $keypath.FullKeyPath -ValueName $keypath.Valuename            
                } Else {   # PolicyState = "Set"            
                    $keypath | Set-GPRegistryValue -Domain $dom -GUID $dest.ID            
                }            
            } Else {            
                CopyValues $keypath.FullKeyPath            
            }            
        }            
    } Else {            
        $error            
    }            
}            
#--------------------------------------------------------------------            
            
            
#--------------------------------------------------------------------            
# Call the main copy routine for the specified scope of $copymode            
#--------------------------------------------------------------------            
Function Copy-GPRegistryValue {            
            
    # Copy user settings            
    If (($copymode -eq "user") -or ($copymode -eq "all")) {            
        CopyValues "HKCU\Software"            
        }            
            
    # Copy computer settings            
    If (($copymode -eq "computer") -or ($copymode -eq "all")) {            
        CopyValues "HKLM\System"            
        CopyValues "HKLM\Software"            
        }            
}            
#--------------------------------------------------------------------            
            
# Start the copy            
Copy-GPRegistryValue            
            
#   ><>

 

 

Attachment: Copy-GPRegistryValue.p-s-1.txt

Can you help me?  Yes!

If you would like to have me or another Microsoft PFE visit your company and assist with the ideas presented in this blog post, then contact your Microsoft Premier Technical Account Manager (TAM) for booking information.

For more information about becoming a Microsoft Premier customer email PremSale@microsoft.com.  Tell them GoateePFE sent you.

Sharing Links
Comments
  • @SMBC4100

    Sounds like the same error that both myself and Mark Flynn is having, but it seems that the blogger doesn't visit his post anymore since we haven't gotten any replies yet.

  • @Anders Libach Johansen

    Thanks for that do you guys run Windows 2003 DC's as well? Could this be the issue?

  • Hi everyone,

    I've not replied to comments on this post in a while.  Point taken.  My apologies.  Thanks for the feedback.

    I went back to the lab today and tried some assorted scenarios.  I install the RSAT SP1 on a Windows 7 client, and then joined it to three different domains to test the Group Policy module using "Get-GPO -All".

    1.  In the 2008 R2 domain of course it worked.

    2.  In the 2003 R2 with AD Web Service it worked.

    3.  In the 2003 R2 without AD Web Service it also worked.

    Based on my testing the Group Policy module should work against a pure 2003 domain.

    That means there is something hinky with either my script or your environment.  The script uses simple error handling which may not cover every scenario and could give misleading messages.

    Please change the line:

      $ErrorActionPreference = "SilentlyContinue"

    to:

      $ErrorActionPreference = "Stop"

    Then reproduce the error again, and type this at the console:

      $error[0] | fl * -force

    Send me the output via the Email Blog Author link (top right).  This should point us in the right direction.

    Thanks,

    Ashley

    @GoateePFE

  • On further investigation I realized that the script uses the AD cmdlets to validate the $dom parameter.  I was not trapping for a case without the AD web service.  We can eliminate most of this so that it will run in a pure 2003 environment.

    Remove the line that says “Import-Module ActiveDirectory”.  Then find these lines:

    if ($dom -eq $null) {            

       $dom = (Get-ADDomain).DNSRoot            

    } else {            

       $dom = (Get-ADDomain -Identity $dom).DNSRoot            

       If ($error.Count -ne 0) {            

           "Domain name does not exist.  Please specify a validdomainFQDN."            

           $error            

           Return            

       }            

    }    

    And replace with:

    if ($dom -eq $null) {            

       $dom = $env:UserDNSDomain

    }

    That should remove any dependencies on the ADWS and get rid of the error you were seeing.  Just make sure that you correctly specify the FQDN in the $dom parameter on the command line.

    @GoateePFE

  • Well its working great for me! :) Saved me countless hours and is speeding up our consolodation project!

    Great Script!

    Many Thanks

    James

  • This is an awesome script, but it does have some bugs and limitation as others have noted in the comments. I have fixed some of the bugs and added logging to a text file. My updated script is here:

    http://fileshar.es/n9H2Csw

    Once I get the permissions fixed the script should also be available here:

    webstorage.deptive.co.nz/.../copy-gpregistryvalue.ps1

  • Great job....awesome scripting !!!!!

    You saved my day....BIG THX !!!

  • Can you explain the benefit of doing this?

    I know it may "tidy things up" but will it actually improve performance?

  • Hi Thom,

    That's a great question.  You can make a case for larger or smaller policies, but it all depends on the administrative needs.  This article lays out the pros and cons:

    technet.microsoft.com/.../2008.01.gpperf.aspx

    Personally I prefer fewer, larger policies.  Regardless, this script is handy, because this is a popular request from GPO admins.  It is helpful when testing settings in separate policies and then rolling them up into a larger production policy.

    Thanks for the question,

    Ashley (GoateePFE)

  • One of the problems I had running this script was not bein able to reach the primary domain controller of my test environment.
    The solution was to add the "-Server " switch to all the GP powershell commandlets.

  • I took this script and ran it but it did not do anything. How do you run it? If I have GPONum1 and GPONum2 how do I merge them with this script?

  • unable to copy registry setting to new GPO:
    Domain: labtest.Local
    Source GPO: ctxsession
    Destination GPO: newmergedgpo
    New Destination: True
    CopyMode: all

    HKCU\Software
    Get-GPRegistryValue : The following Group Policy registry setting was not found : "HKEY_CURRENT_USER\Software".
    Parameter name: keyPath
    At C:\Users\Administrator\desktop\copy-gpregistryvalue.ps1:159 char:32
    + $path = Get-GPRegistryValue <<<< -GUID $src.ID -Key $Key
    + CategoryInfo : InvalidArgument: (Microsoft.Group...tryValueComm
    and:GetGPRegistryValueCommand) [Get-GPRegistryValue], ArgumentException
    + FullyQualifiedErrorId : UnableToRetrievePolicyRegistryItem,Microsoft.GroupPolicy.Commands.GetGPRegistryValueCommand

    HKLM\System
    Get-GPRegistryValue : The following Group Policy registry setting was not found : "HKEY_LOCAL_MACHINE\System".
    Parameter name: keyPath
    At C:\Users\Administrator\desktop\copy-gpregistryvalue.ps1:159 char:32
    + $path = Get-GPRegistryValue <<<< -GUID $src.ID -Key $Key
    + CategoryInfo : InvalidArgument: (Microsoft.Group...tryValueComm and:GetGPRegistryValueCommand) [Get-GPRegistryValue], ArgumentException
    + FullyQualifiedErrorId : UnableToRetrievePolicyRegistryItem,Microsoft.GroupPolicy.Commands.GetGPRegistryValueCommand

    HKLM\Software


    KeyPath : Software\Policies
    FullKeyPath : HKEY_LOCAL_MACHINE\Software\Policies
    Hive : LocalMachine

    KeyPath : Software\Policies
    FullKeyPath : HKEY_LOCAL_MACHINE\Software\Policies
    Hive : LocalMachine

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment