Home / server / Questions / 1082032
Accepted
James Connigan
Asked: 2021-10-29 12:27:34 +0800 CST

How to restore Group Policy from Dead Domain Controller

  • 772

Had a domain controller die, physical machine, was able to p2v the hard drive and I have it attached to the new virtual server.

Server 2016 Standard.

No there was no replica, the only access I have to the old DC is on the p2v'd harddrive

This is not a mission critical DC but there was a lot of GPO's that were in use.

Where can I find the Group Policy objects for the domain? I have done a lot of googling and looks like they are in the sysvol/domain/policies folder.

Can I just copy and paste?

Is there a correct way to restore group policy objects from a dead hard drive?

Please note these are not local policies there are domain group polices.

group-policy active-directory windows-server-2016

1 Answers

  1. Best Answer

    Well, I'll start by saying the obvious...never run a single DC...and also always backup your GPO's on a regular scheduled basis using the actual backup GUI or powershell cmdlets.

    That said, you've got a lot of manual work ahead of you. And things will get dicey.

    Your best bet with all the GPOs, especially with the default domain policy and default domain controllers policy is to look at each of the old GPOs settings and copy them into the new ones.

    Note that I don't think it's possible to see where they were scoped to or even what they were called. I don't think that info is available in the sysvol but maybe someone else will say otherwise.

    FIRST: I would try to take your P2V drive and create a VM based on it and get the VM up even if it's off network. It would be much easier to see what the GPOs really were.

    SECOND...IF YOU CAN'T:

    1. Create a new "test GPO" in the GPMC
    2. Make note of the new "test GPO"'s guid in its properties
    3. go to the sysvol/domain/policies folder and into the new GPO GUID folder
    4. copy/paste the old Machine, User and GPT subfolders from the original P2V drive under one of the GPO's in that drive into the new GPO GUID folder, overwriting the new Machine, User, and GPT folders.
    5. Edit the new GPO, browse to any unconfigured policy setting and open it and set and unset the setting. This is because the settings won't be shown if you don't change something.
    6. Do the same with any "preference" in the GPO, then close the GPO.
    7. You will have to manually set the security permissions and scope and filters again.
    8. I would suggest taking note of those settings and then editing a brand new GPO to mimic those settings you see in the "restored' GPO. It would be cleaner that way, then when you have all of the restored GPOs and their settings CLONED then you can delete the "test/restore" ones.

    Hope that helps. It's going to be a lot of manual work, but at least you'll see the settings and can somehow recreate them.

    • 1