Welcome to ITFreeTraining video on Starter GPO’s and copying Group Policy Objects.
If you create a lot of Group Polices that are simpler, this video will show you how
to speed up that process. This video also looks at how to copy Group Policy Objects
in the same domain and between different domains. You have probably come across a template before.
For example, in an office it is not uncommon for the office to have a fax template. Each
time you want to send a fax, you simple copy the fax template and make any changes that
you require. Group Policy has a template feature called
Starter GPO’s. Since there is already a section in Group Policy called Administrative
Templates, it is mostly likely Microsoft did not want to use the term Template again. For
this reason, the name Starter GPO’s was used but essentially they work the same way
as a traditional template would work. Although a starter GPO is copied to a new
Group Policy just like you would expect a template to be, it does not include all the
settings in Group Policy. The Starter GPO only includes the Administrative Template
part of Group Policy. If you require all the settings, there is also a copy option that
I will look at which will allow you to copy a complete Group Policy Object. I will now
change to my Windows Server to have a look at how to configure starter GPO’s and copy
Group Policy Objects. First of all I will open Group Policy Management
from administrative tools under the start menu. The first feature of Group Policy that
I will look at is Starter GPO’s found under Starter GPO’s.
Starter GPO’s are not configured by default. To start using starter GPO’s, select the
option Create Starter GPO’s folder. You will notice that once this option is selected
a number of Starter GPO’s are created. These were added with Windows Server 2008 R2. If
you are not running Windows Server 2008 R2, you can add these Starter GPO’s by downloading
the latest version of the Remote Server Administration Tools.
The first starter GPO is Windows Vista EC Computer. EC stands for enterprise client.
Windows Vista EC Computer is a number of Computer Group Policy settings that Microsoft recommends
for the standard enterprise client. Below this, you can see Windows Vista SSLF
Computer. SSLF standard for Specialized Security Limited Functionality. SSLF is used for highly
secure environments and environment with a high risk of attack. It is designed to protect
information of the highest value, for example government systems holding confidential information.
Any SSLF starter GPO’s tighten up security on the system making it more secure and residence
to attack. This starter GPO is for the computer side
of Group Policy, but there is also starter GPO’s for the user side as well.
If you want to create a new starter GPO, you can right click on Starter GPO and select
new. To create the starter GPO, all you need to do is enter in a name and a comment if
you wish. Once the Starter GPO is created, I can than
right click on it and select edit. Notice that the Starter GPO’s only has Administrative
Templates, you cannot configured any other settings in a Starter GPO.
For this demonstration, I will configure the desktop wallpaper under user configuration.
You are free to configure as many settings that you want. Once complete, the next step
is to go back into Group Policy Management and create a new Group Policy Object.
In this case, I will create a new Group Policy under London by selecting the option Create
a GPO in this domain and link it here. In this case, I will enter in the name as
London Office. Under this, notice that I have the option to select source Starter GPO. In
this case, I will select the starter GPO that I just created called Default Branch Office.
The Group Policy has been created and linked under the London OU using the starter GPO
as a template. If I edit the Group Policy Object, notice how I have the option to edit
any setting in the Group Policy that I want. In the Starter GPO, I only had the option
to edit Administrative Templates. If I expand down in the user settings and
down to the Desktop settings, notice that the setting Desktop Wallpaper that I configured
in the starter GPO is configured. If I edit the settings, notice I have complete control
over it, I can even select the option not configured. Once the starter GPO is used to
create a Group Policy object, you have complete control over which settings you change or
leave. Also, any changes that you make do not affect the original starter GPO.
If you know what default settings you want to use in advance, starter GPO’s can be
very useful. In some case you may already have the Group Policy created that you want
to copy and later modify. This Group Policy may be in the same domain or a different domain.
If the Group Policy is in the same domain, it is a simple matter to copy the Group Policy
Object. In this case, I will open Active Directory Users and Computers and create a new Organizational
Unit called Washington. Once the OU is created, I can go back into Group Policy Management
and press F5 to refresh the view. In this case, I want to copy an existing Group
Policy and link to Washington. To do this, expand into Group Policy Objects, right click
the Group Policy Object that you want to copy and select copy. The next step is to right
click Group Policy Objects and select paste. You will get the option to keep the existing
permissions or use the default permissions. If you are not sure, select the option for
default permissions for new GPO’s. It does not take long to copy the Group Policy, once
complete, I will rename the group Policy Object. Once the Group Policy object is copied and
a suitable name given, the next step is to link the Group Policy to the required OU.
In some cases, you may want to copy a Group Policy Object from a different domain. If
you want to copy the Group Policy Object from domain to domain, one trick you can do is
to right click the Group Policy object that you want to copy and select the option Back
Up. In this case, I will choose to Back Up the
Group Policy to the desktop. Once I enter in the optional description, I will press
Back Up to Back Up the group Policy to the desktop. Once the backup is complete, the
next step is to import the settings. Since the settings will be imported, it is
a good idea to create a new Group Policy. If you use an existing Group Policy Object,
you will merge the backed up setting with the settings that exist in that Group Policy.
In this case, I will create a new Group Policy Object LA. Once this is created, I can right
click the Group Policy Object and select the option Import Settings.
Once in the import wizard, I will skip pass the welcome screen. The next screen gives
you the option to back up the GPO before starting the import. This is a good idea if you are
merging the settings with an existing Group Policy. In this case, I am importing the settings
into a brand new empty Group Policy so I will not worry about backing up the settings.
On the next screen, I need to give the path where I backed up the previous Group Policy.
On the next screen, it should have a list of the Group Policy objects that are available
to be imported. It is a good idea before the import to press the button view settings.
This will allow you to see the settings that will be imported.
Before the settings are imported, the wizard will do a quick check for any UNC paths. UNC
paths access a share directly by the server and share name. For this reason, if you import
the settings from a different forest, it is possible that settings exist that reference
a server that is not accessible from this domain.
Once I press finish on the wizard, the Group Policy settings will be imported. Using this
method gives you a way of copying Group Policy between domains in different forests.
Thanks for watching this video from ITFreeTraining. This video is part of the free Active Directory
course. For more videos from this course and others, please feel free to visit our website
or YouTube channel. You can also subscribe to are channel to ensure that you have the
latest videos. Thanks for watching and see you next time.
Thanks for watching this video for ITFreeTraining, just one of the videos in these series for
Active Directory. See you next time.