First I'll say that I've just now discovered that my practice of making changes directly to the Default Domain Policy isn't the recommended way of doing things. I admit I'm not sure why this is the case, but I'll go with it.
Now, that said... I'm preparing to wipe and reinstall the OS for my WSE 2012 R2 PDC. I've made several changes to the Default Domain Policy over the past year—being careful to save a backup with each change—and I'm going to want to restore those changes to the new domain.
But I think this can't be done with my current backups, due to the new SIDs that'll be generated with the reinstall (among other unknown complications that may arise).
What I'd like to do is write a script/program against an API of some sort to read from the policy ONLY THE FEW SETTINGS THAT I'VE CHANGED and save them into a file for later restoration back to the new server. I don't have many, but I do have enough to make prohibitive a task of wading through the TreeView, tracking them down and manually copying them one-by-one.
The XML files that are produced by the standard GPO backup feature (as well as Backup-GPO
) appear far more complex than the minimum necessary and I fear trouble if I use them to restore to the new GPO. I don't need all the plumbing, just the settings/values that I've changed from default.
In other words, I'm looking for a minimalist GPO backup/restore mechanism—even if I have to write it myself. The files produced by the current one seem to be overkill, like trouble waiting to happen.
Not for nothing, but if you edit the policy in GPMC you can filter on configured settings so that you don't have to wade through all of the settings.
The filter will filter on only those settings that have been configured under the Administrative Templates node, either for Computer Configuration Settings or User Configuration Settings, whichever set of settings you've configured. I'm not suggesting that this is a solution, I'm suggesting that if you've only configured a few settings then this would be a quick way to see all of them without having to look section by section for configured settings.
Here's an example:
Additionally, the Settings tab for the GPO in the GPMC will also show you all of the configured settings. Again, if there are only a few, this might be quicker than trying to perform a backup/restore/migration.