Whether you want to back up a single GPO or
the entire group of GPOs for the domain, there are scripts to handle
these tasks. Not only can you back up GPOs, you can also use the script
to restore them. Other scripts allow you to see the backup location
where the GPOs have been archived.
1. BackupGPO.wsf
This
script backs up a single GPO in the current domain or defined domain. A
backup location is required; the Comment and Domain switches are
optional. The script stores each GPO in a separate folder, which is
uniquely named after the Backup IDs. This is to ensure that each GPO
remains autonomous. The Comment switch becomes more useful when you are
viewing saved versions with other GPMC scripts.
Syntax
Usage: BackupGPO.wsf GPOName BackupLocation [/Comment:value] [/Domain:value]
GPOName: GPO name or ID. Note: Use double quotes if the policy name has multiple words,
as in the following example.
BackupLocation: File system or UNC share location to back up to.
Comment: This switch is optional. Use " " for spaces with comment text.
Domain: DNS name of domain; if left blank, it will default to the current domain.
Example & Output
This example backs up only the Default Domain Policy to the Universal Naming Convention (UNC) path of \\server1\gpobackup.
cscript BackupGPO.wsf "Default Domain Policy" \\server1\gpo-backup /comment:"Default Domain
Policy 11/2/2007"
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.
Found GPO 'Default Domain Policy'
Done.
Backed up GPO Default Domain Policy with the following properties:
GPO ID: {31B2F340-016D-11D2-945F-00C04FB984F9}
Timestamp: 11/2/2007 9:43:44 AM
Backup ID: {A19258BC-2584-4081-80C6-24E5F6BD19F2}
2. BackupAllGPOs.wsf
This
script backs up all of the GPOs in the current domain or defined
domain. A backup location is required; the Comment and Domain switches
are optional. This script stores the GPOs in separate folders with
unique names using the Backup ID. The comment switch is useful for
documenting any essential information regarding the GPO, which can then
be leveraged using other scripts.
Syntax
Usage: BackupAllGPOs.wsf BackupLocation [/Comment:value] [/Domain:value]
BackupLocation: File system or UNC share location to back up to.
Comment: Comment switch is optional. Use " " if you have multiple words.
Domain: DNS name of domain; if left blank, it will default to the current domain.
Example & Output
In this example, we use the script to back up all of the GPOs in the current domain to the GPO-Backup share on Server1.
cscript BackupAllGPOs.wsf \\server1\gpo-backup
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.
== Found 2 GPOs in fabrikam.com to backup ==
Backed up GPO 'Default Domain Policy' with the following properties:
GPO ID: {31B2F340-016D-11D2-945F-00C04FB984F9}
Timestamp: 10/31/2007 10:43:04 PM
Backup ID: {4C02A6A1-3571-4D9E-9796-3A3401280197}
Backed up GPO 'Default Domain Controllers Policy' with the following properties:
GPO ID: {6AC1786C-016F-11D2-945F-00C04fB984F9}
Timestamp: 10/31/2007 10:43:20 PM
Backup ID: {8A9A15DB-01EC-485E-BEE3-7F0B06AA18B1}
Backup succeeded for 2 GPOs.
Backup failed for 0 GPOs.
3. RestoreGPO.wsf
This
script restores a single GPO from the backup location. If you have
archived the GPO multiple times to the same backup location, the script
restores only the most recent backup. When you do not specify a domain
or a domain controller, the restore occurs in the current domain.
Syntax
Usage: RestoreGPO.wsf BackupLocation BackupID [/Domain:value] [/DC:value]
BackupLocation: File system location where the backup is located.
BackupID: GPO name or backup ID (GUID) of the backup to use.
Domain: DNS name of domain.
DC: Netbios name of domain controller to use.
Example & Output
This script restores the Default Domain Policy from the share named gpo-backup.
cscript RestoreGPO.wsf \\server1\gpo-backup "Default Domain Policy"
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.
Backup found:
ID: {A19258BC-2584-4081-80C6-24E5F6BD19F2}
Timestamp: 11/2/2007 9:43:44 AM
GPO ID: {31B2F340-016D-11D2-945F-00C04FB984F9}
GPO Name: Default Domain Policy
Comment: Default Domain Policy 11/2/2007
Restoring GPO Default Domain Policy from \\server1\gpo-backup\\{A19258BC-2584-40
81-80C6-24E5F6BD19F2} in domain Fabrikam.com.
GPO 'Default Domain Policy' has been restored.
