[gptalk] Re: Moving Test Policies into Production
- From: Thorbjörn Sjövold <thorbjorn.sjovold@xxxxxxxxxxxxxxx>
- To: <gptalk@xxxxxxxxxxxxx>
- Date: Wed, 25 Apr 2007 22:11:41 +0200
Jack,
perhaps I misunderstand, but when you say "rename", do you mean like hacking
the GUID or changing the display name? Because GPOs are not identified to the
system by (display) name, but rather GUIDs, and just changing the display name
will not do anything different to your clients.
The by far best method to accomplish the migration of GP settings from a
testing environment or OU to a live environment, is to set up a programmatic
process using the GPMC APIs (instead of doing it manually) that you can access
from for example from VBScript, PowerShell or a regular programming language if
you prefer that, this way you can move GPOs from test to live really fast and
reduce the chance of human errors, over and over again.
Here is the MSDN docs for GPMC:
http://msdn2.microsoft.com/en-us/library/aa814316.aspx
In this case you describe you could either manage the links, i.e. remove them
from the old GPO and add to the new GPO using IGPMGPOLink GPMC interface or
what is normally the case when moving from test to live environment, use the
backup/import methods (this is actually something you can do from the GPMC GUI
directly if you do not like the more automated approach, select your test GPO,
right click, back it up and then select your live GPO, right click and do an
import). Be vary though since that basically means that you will replace all
the settings in the GPO you import into. It is not possible to only move
certain settings but rater it is a all or nothing approach. Consider yourself
warned, I have seen some nasty things in really large environments caused by a
few, not to well prepared, mouse clicks... The same warning goes for doing it
using the APIs, but the organizations doing it this way normally have a more
process oriented way of working with Group Policy.
When the TechNet magazine downloads are uploaded for the May issue, see the
link below, there is actually a number of GP management samples using
PowerShell that you can download and one of the functions is named CopyGpo()
that would fit your needs pretty well.
http://www.microsoft.com/technet/technetmag/codeDownload.aspx?year=2007
But if you are still a VBScript/COM guy, there is actually a WSH script that
comes with GPMC that does the exact same thing, the script is located here
%ProgramFiles%\GPMC\Scripts\CopyGPO.wsf (on a computer with GPMC), and is
pretty straight forward to use.
HTH,
Thorbjörn Sjövold
Special Operations Software
www.specopssoft.com <http://www.specopssoft.com>
thorbjorn.sjovold a t specopssoft.com
Download our free tool for remote Gpupdate with graphical reporting,
http://www.specopssoft.com/products/specopsgpupdate/
<http://www.specopssoft.com/products/specopsgpupdate/>
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Kopenski, Jack
Sent: den 25 april 2007 19:26
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Moving Test Policies into Production
Hi,
I am trying to identify a good method of moving group policies from a testing
phase, to a production mode. I have 50 OU's (offices) and each has a
"computer" OU. I have a single GPO called "WiFi Settings" that all 50 are
linked to.
I also have a "Test" OU where I am testing a revised policy called "WiFi2
Settings". Now that I am done testing the revised policy, and rather than link
the "WiFi2 Settings" GPO to all 50 production OU's, can I simply disable the
link to "WiFi Settings", rename it to "WiFi Old", and rename "WiFi2 Settings"
to "WiFi Settings"? By the way, this GPO runs a script so there are files
involved.
By renaming the original GPO to "old", and renaming the new one to name all 50
OU's were originally linked to, will that cause any problems, or is there
better process?
Thank you,
Jack
The contents of this e-mail are intended for the named addressee only. It
contains information that may be confidential. Unless you are the named
addressee or an authorized designee, you may not copy or use it, or disclose it
to anyone else. If you received it in error please notify us immediately and
then destroy it.
Other related posts:
