Finally! Copy and merge GPOs! PowerShell saves the day!
UPDATE
This script has been updated here.
The Problem
I wish I had this script five years ago. At the time I was searching for a way to combine or merge GPOs, but there simply wasn’t a way to do it. And today there still isn’t a way to do it… until POWERSHELL! Almost every environment I see (including my own former environment) has a collection of GPOs that have evolved over time and really need to be consolidated and cleaned up.
In Windows Server 2008 R2 we released a new PowerShell module for Group Policy administration. I haven’t seen much written about it, and I don’t think many people realize it is there.
I’ve been sitting on this script since last September, and ultimately I’d like to convert it to an advanced function. For now though I wanted to get this code published for the benefit of the community.
The Solution
You can use this PowerShell script to copy and merge GPOs. Yee haw! Essentially the script does a Get-GPRegistryValue from the source policy and a Set-GPRegistryValue on the destination policy. It recursively enumerates all settings in the source policy and copies them to the destination policy. But nothing is ever that simple. It turns out that there is a special trick to getting and setting a policy value that is in disabled status. After that hurdle it was smooth sailing. See the code for the details on this part.
Testing It For Yourself
You’ll need to run the script on Windows Server 2008 R2 or Windows 7 with the RSAT for Active Directory and Group Policy Management features installed. Here are the steps to test it in your environment:
1. In GPMC create a new GPO called "Starter Computer" based on one of the GPO computer templates.
2. In GPMC create a new GPO called "Starter User" based on one of the GPO user templates.
3. Run the script without switches for syntax: .\copy-gpregistryvalue.ps1
4. Run the script: .\copy-gpregistryvalue.ps1 -src "Starter Computer" -dest "Merged GPO" -newDest
5. Run the script: .\copy-gpregistryvalue.ps1 -src "Starter User" -dest "Merged GPO"
6. View the new "Merged GPO" settings in GPMC.
7. Compare these settings with the ones from the two source GPOs. They should match everything except the comments (which are unsupported by the current cmdlets).
This demo uses starter policies that separately contain user and computer settings, but you can use it just the same with existing source and destination policies containing both user and computer settings.
Limitations
Note that the Get/Set-GPRegistryValue cmdlets do not support the policy comments, therefore these will not be present in the destination GPO.
Also note that due to limitations of the GPO cmdlets we only copy registry-based settings in the policy. Other settings such as software installations, audit policies, file system permissions, etc. cannot be copied at this time.
Preference are not copied in the current version of the script. You could easily update the script to call similar cmdlets for Get/Set-GPPrefRegistryValue. I’ll leave that up to you.
Conclusion
Now go clean up all of those policies that need to be consolidated in your environment! (But first back them up with Backup-GPO.)
Resources
TechNet: Group Policy Cmdlets in Windows PowerShell
#--------------------------------------------------------------------
# Copy GPO Registry Settings
# Ashley McGlone, Microsoft PFE
# https://blogs.technet.com/b/ashleymcglone
# January 2011
#
# Parameters:
# dom FQDN of the domain where the GPOs reside
# src string name of the GPO to copy settings from
# dest string name of the GPO to copy settings to
# newDest switch to create dest GPO if it does not exist
# copymode part of GPO to copy: all, user, computer
#--------------------------------------------------------------------
Param (
$dom,
$src,
$dest,
[switch]$newDest,
$copymode
)
# We must continue on errors due to the way we enumerate GPO registry
# paths and values in the function CopyValues.
$ErrorActionPreference = "SilentlyContinue"
$error.PSBase.Clear()
Import-Module ActiveDirectory
Import-Module GroupPolicy
#--------------------------------------------------------------------
# Help
#--------------------------------------------------------------------
if ($dom -eq $null -and `
$src -eq $null -and `
$dest -eq $null -and `
$copymode -eq $null) {
""
"Copy-GPORegistryValue by Ashley McGlone, Microsoft PFE"
"For more info: https://blogs.technet.com/b/ashleymcglone"
""
"This script copies registry-based GPO settings from one GPO into another."
"Use this script to copy and/or merge policy settings."
"NOTE: This version does not copy GPO preferences."
""
"Syntax:"
".\Copy-GPRegistryValue.ps1 [-dom DomainFQDN] -src `"Source GPO`""
" -dest `"Destination GPO`" [-newDest]"
" [-copymode all/user/computer]"
""
"The -dom switch will default to the current domain if blank."
"The -copymode will default to all if blank."
"The -newDest switch will create a new destination GPO of the specified"
"name. If the GPO already exists, then the copy will proceed."
""
Return
}
#--------------------------------------------------------------------
# Validate parameters
#--------------------------------------------------------------------
if ($dom -eq $null) {
$dom = (Get-ADDomain).DNSRoot
} else {
$dom = (Get-ADDomain -Identity $dom).DNSRoot
If ($error.Count -ne 0) {
"Domain name does not exist. Please specify a valid domain FQDN."
$error
Return
}
}
if ($src -eq $null) {
"Source GPO name cannot be blank."
Return
} else {
$src = Get-GPO -Name $src
If ($error.Count -ne 0) {
"Source GPO does not exist. Be sure to use quotes around the name."
Return
}
}
if ($dest -eq $null) {
"Destination GPO name cannot be blank."
Return
} else {
if ($newDest -eq $true) {
$desttemp = $dest
$dest = New-GPO -Name $desttemp
If ($error.Count -ne 0) {
"The new destination GPO already exists."
"Do you want to merge into this GPO (y/n)?"
$choice = Read-Host
if ($choice -eq "y") {
$dest = Get-GPO -Name $desttemp
} else {
Return
}
}
} else {
$dest = Get-GPO -Name $dest
If ($error.Count -ne 0) {
"Destination GPO does not exist. Be sure to use quotes around the name."
Return
}
}
}
if ($copymode -eq $null) {
$copymode = "all"
} else {
if ($copymode -ne "all" -and `
$copymode -ne "user" -and `
$copymode -ne "computer") {
"copymode must be one of the following values:"
"all, user, computer"
Return
}
}
#--------------------------------------------------------------------
#--------------------------------------------------------------------
# Echo parameters for this run
#--------------------------------------------------------------------
""
"Domain: $dom"
"Source GPO: $($src.DisplayName)"
"Destination GPO: $($dest.DisplayName)"
"New Destination: $newDest"
"CopyMode: $copymode"
""
#--------------------------------------------------------------------
#--------------------------------------------------------------------
# Copy GPO registry values recursively beginning at a specified root.
#--------------------------------------------------------------------
# THIS IS THE HEART OF THE SCRIPT.
# Essentially this routine does a get from the source and a set on
# the destination. Of course nothing is ever that simple, so we have
# to account for the policystate "delete" which disables a setting;
# this is like a "negative set".
# We recurse down each registry path until we find a value to
# get/set.
# If we try to get a value from a path (non-leaf level), then we get
# an error and continue to dig down the path. If we get a value and
# no error, then we do the set.
# User values have a single root: HKCU\Software.
# Computer values have two roots: HKLM\System & HKLM\Software.
# You can find these roots yourself by analyzing ADM and ADMX files.
# It is normal to see an error in the output, because all of these
# roots are not used in all policies.
#--------------------------------------------------------------------
Function CopyValues ($Key) {
$Key
$error.PSBase.Clear()
$path = Get-GPRegistryValue -GUID $src.ID -Key $Key
$path
If ($error.Count -eq 0) {
ForEach ($keypath in $path) {
$keypath
$keypath | ForEach-Object {Write-Host $_}
If ($keypath.HasValue) {
$keypath.PolicyState
$keypath.Valuename
$keypath.Type
$keypath.Value
If ($keypath.PolicyState -eq "Delete") { # PolicyState = "Delete"
Set-GPRegistryValue -Disable -Domain $dom -GUID $dest.ID `
-Key $keypath.FullKeyPath -ValueName $keypath.Valuename
} Else { # PolicyState = "Set"
$keypath | Set-GPRegistryValue -Domain $dom -GUID $dest.ID
}
} Else {
CopyValues $keypath.FullKeyPath
}
}
} Else {
$error
}
}
#--------------------------------------------------------------------
#--------------------------------------------------------------------
# Call the main copy routine for the specified scope of $copymode
#--------------------------------------------------------------------
Function Copy-GPRegistryValue {
# Copy user settings
If (($copymode -eq "user") -or ($copymode -eq "all")) {
CopyValues "HKCU\Software"
}
# Copy computer settings
If (($copymode -eq "computer") -or ($copymode -eq "all")) {
CopyValues "HKLM\System"
CopyValues "HKLM\Software"
}
}
#--------------------------------------------------------------------
# Start the copy
Copy-GPRegistryValue
# ><>
Copy-GPRegistryValue.p-s-1.txt
Comments
Anonymous
January 19, 2011
200 proof powershell goodness! Too many GPOs that need to effect all computers but don't have the time to merge them into one? Check out the below link! blogs.technet.com/.../finally-copy-and-merge-gpos-powershellAnonymous
January 20, 2011
Thx... this is greatAnonymous
January 26, 2011
Great but only limited to registry based settings.Anonymous
February 24, 2011
tired to merge a large GPO. Got a call depth error as it reached 1000. any ideas for workaround?Anonymous
February 24, 2011
Hi Bobby, Congratulations on exploring the depths of PowerShell. The recursion depth limit is hard-coded in PowerShell v1 and v2. Although that may change in v3, for now there is no way to change the allowable recursion depth. I am not aware of any work arounds. Exactly how large is the GPO you are trying to merge? AshleyAnonymous
February 25, 2011
The USGCB Windows 7 GPO are the ones that I'm trying to merge into one GPO using this script. These are in xml format. Is there a way to merge these using any other process? I saw this post where the function could be put in but I'm not a coder and don't know where this would be inserted in the script. www.google.com/url Thanks, BobbyAnonymous
March 04, 2011
The comment has been removedAnonymous
March 04, 2011
The comment has been removedAnonymous
March 16, 2011
So when you specify merging the group policy do you mean he target GPO settings are not overwritten but rather the source GPO settings are appended? Will this work for User Rights Assignments?Anonymous
March 16, 2011
The registry settings in the source GPO will be appended to the target GPO, and anywhere there is a conflict the source GPO settings will overwrite the target. This does not work for user rights assignment, because that falls outside of the registry settings in the policy.Anonymous
May 04, 2011
I dream a day when I don't have to roll my own module to do GPPref editing in powershell...scripts like this give me hope. Keep up the workAnonymous
May 06, 2011
The comment has been removedAnonymous
July 22, 2011
Hi I have tried using your script to merge GPO's from my Domain into one. But I recieve the following error each time i try. *** Real GPO's replaced with GPO A & Merged GPO *** .MergeGPO_testScript.ps1 -src "GPO A" -dest "Merged GPO" -newDest Source GPO does not exist. Be sure to use quotes around the name. I double checked and my GPO's exist in Group Policy. Any Ideas? CheersAnonymous
August 22, 2011
@Mark Flynn, Have that one as well... @Ashley McGlone Have copied the names directly from the GPMC. Listing the group policy using the Get-GPO works fine. The syntax I'm using is this: .copy-gpsettings.ps1 -src "NET-GPO-IEsettings" -dest "NET-GPO-IE" -dom ADM.NET.LOCALAnonymous
November 18, 2011
Do I need my DC's to be on Windows Server 2008 R2 for these commands to work? as e have Windows Server 2003 DC's. I am getting an error when running the following: .copy-gpregistryvalue.ps1 -src "Testing" -dest "Starter Computer" I get an error which states: Source GPO does not exist. Be sure to use quotes around the name. Which as you can see I have and the GPO does exist on all DC's Any thoughts? It will be brilliant for our consolodation project we are doing and I will find it really useful if I can use it :)Anonymous
November 18, 2011
@SMBC4100 Sounds like the same error that both myself and Mark Flynn is having, but it seems that the blogger doesn't visit his post anymore since we haven't gotten any replies yet.Anonymous
November 18, 2011
@Anders Libach Johansen Thanks for that do you guys run Windows 2003 DC's as well? Could this be the issue?Anonymous
November 18, 2011
The comment has been removedAnonymous
November 21, 2011
On further investigation I realized that the script uses the AD cmdlets to validate the $dom parameter. I was not trapping for a case without the AD web service. We can eliminate most of this so that it will run in a pure 2003 environment. Remove the line that says “Import-Module ActiveDirectory”. Then find these lines: if ($dom -eq $null) { $dom = (Get-ADDomain).DNSRoot } else { $dom = (Get-ADDomain -Identity $dom).DNSRoot If ($error.Count -ne 0) { "Domain name does not exist. Please specify a validdomainFQDN." $error Return } } And replace with: if ($dom -eq $null) { $dom = $env:UserDNSDomain } That should remove any dependencies on the ADWS and get rid of the error you were seeing. Just make sure that you correctly specify the FQDN in the $dom parameter on the command line. @GoateePFEAnonymous
December 01, 2011
Well its working great for me! :) Saved me countless hours and is speeding up our consolodation project! Great Script! Many Thanks JamesAnonymous
December 21, 2011
This is an awesome script, but it does have some bugs and limitation as others have noted in the comments. I have fixed some of the bugs and added logging to a text file. My updated script is here: http://fileshar.es/n9H2Csw Once I get the permissions fixed the script should also be available here: webstorage.deptive.co.nz/.../copy-gpregistryvalue.ps1Anonymous
October 15, 2013
Great job....awesome scripting !!!!! You saved my day....BIG THX !!!Anonymous
November 12, 2013
Can you explain the benefit of doing this? I know it may "tidy things up" but will it actually improve performance?Anonymous
November 12, 2013
Hi Thom, That's a great question. You can make a case for larger or smaller policies, but it all depends on the administrative needs. This article lays out the pros and cons: technet.microsoft.com/.../2008.01.gpperf.aspx Personally I prefer fewer, larger policies. Regardless, this script is handy, because this is a popular request from GPO admins. It is helpful when testing settings in separate policies and then rolling them up into a larger production policy. Thanks for the question, Ashley (GoateePFE)Anonymous
April 28, 2014
One of the problems I had running this script was not bein able to reach the primary domain controller of my test environment.
The solution was to add the "-Server " switch to all the GP powershell commandlets.Anonymous
May 14, 2014
I took this script and ran it but it did not do anything. How do you run it? If I have GPONum1 and GPONum2 how do I merge them with this script?Anonymous
May 22, 2014
unable to copy registry setting to new GPO:
Domain: labtest.Local
Source GPO: ctxsession
Destination GPO: newmergedgpo
New Destination: True
CopyMode: all
HKCUSoftware
Get-GPRegistryValue : The following Group Policy registry setting was not found : "HKEY_CURRENT_USERSoftware".
Parameter name: keyPath
At C:UsersAdministratordesktopcopy-gpregistryvalue.ps1:159 char:32
+ $path = Get-GPRegistryValue <<<< -GUID $src.ID -Key $Key
+ CategoryInfo : InvalidArgument: (Microsoft.Group...tryValueComm
and:GetGPRegistryValueCommand) [Get-GPRegistryValue], ArgumentException
+ FullyQualifiedErrorId : UnableToRetrievePolicyRegistryItem,Microsoft.GroupPolicy.Commands.GetGPRegistryValueCommand
HKLMSystem
Get-GPRegistryValue : The following Group Policy registry setting was not found : "HKEY_LOCAL_MACHINESystem".
Parameter name: keyPath
At C:UsersAdministratordesktopcopy-gpregistryvalue.ps1:159 char:32
+ $path = Get-GPRegistryValue <<<< -GUID $src.ID -Key $Key
+ CategoryInfo : InvalidArgument: (Microsoft.Group...tryValueComm and:GetGPRegistryValueCommand) [Get-GPRegistryValue], ArgumentException
+ FullyQualifiedErrorId : UnableToRetrievePolicyRegistryItem,Microsoft.GroupPolicy.Commands.GetGPRegistryValueCommand
HKLMSoftware
KeyPath : SoftwarePolicies
FullKeyPath : HKEY_LOCAL_MACHINESoftwarePolicies
Hive : LocalMachine
KeyPath : SoftwarePolicies
FullKeyPath : HKEY_LOCAL_MACHINESoftwarePolicies
Hive : LocalMachineAnonymous
October 01, 2014
i have the same Problem "Get-GPRegistryValue : The following Group Policy registry setting was not found : "HKEY_CURRENT_USERSoftware"." How can i fix this?Anonymous
November 10, 2014
i just used the xp SSF starter gpo for user and computer
it works fine until i reach a endless loop
Microsoft.GroupPolicy.PolicyRegistrySetting
HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows NTTerminal ServicesRAUnsolicit
KeyPath : SoftwarePoliciesMicrosoftWindows NTTerminal ServicesRAUnsolicit
FullKeyPath : HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows NTTerminal ServicesRAUnsolicit
Hive : LocalMachine
KeyPath : SoftwarePoliciesMicrosoftWindows NTTerminal ServicesRAUnsolicit
FullKeyPath : HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows NTTerminal ServicesRAUnsolicit
Hive : LocalMachineAnonymous
March 06, 2015
Hi Guys
How do you address the error which states Source GPO does not exist. Be sure to use quotes around the name."? Please adviseAnonymous
June 11, 2015
Do you have Group Policies gone wild? Did you realize too late that it might not be such a good idea to delegate GPO creation to half the IT department? Have you wanted to combine multiple policies into one for simplicity? This blog post is for you.Anonymous
June 11, 2015
Hello Batman,
Please try the updated code here and see if you get the same error:
http://blogs.technet.com/b/ashleymcglone/archive/2015/06/11/updated-copy-and-merge-group-policies-gpos-with-powershell.aspx
Or use the Bat-a-rang. Your pick.
Cheers,
GoateePFEAnonymous
October 08, 2015
A host of reference material for AD and Group PolicyAnonymous
November 05, 2015
Invaluable article - Incidentally , if your company are interested in merging of some PDF files , my secretary encountered a service herehttp://www.altomerge.com/" >AltoMerge.