Score:0

How to restore Group Policy from Dead Domain Controller

lr flag

Had a domain controller die, physical machine, was able to p2v the hard drive and I have it attached to the new virtual server.

Server 2016 Standard.

No there was no replica, the only access I have to the old DC is on the p2v'd harddrive

This is not a mission critical DC but there was a lot of GPO's that were in use.

Where can I find the Group Policy objects for the domain? I have done a lot of googling and looks like they are in the sysvol/domain/policies folder.

Can I just copy and paste?

Is there a correct way to restore group policy objects from a dead hard drive?

Please note these are not local policies there are domain group polices.

Jevgenij Martynenko avatar
us flag
Can you boot up your DC on VM? No network is needed. You only need to be able to login locally as AD admin to backup group policy
Score:1
us flag

Well, I'll start by saying the obvious...never run a single DC...and also always backup your GPO's on a regular scheduled basis using the actual backup GUI or powershell cmdlets.

That said, you've got a lot of manual work ahead of you. And things will get dicey.

Your best bet with all the GPOs, especially with the default domain policy and default domain controllers policy is to look at each of the old GPOs settings and copy them into the new ones.

Note that I don't think it's possible to see where they were scoped to or even what they were called. I don't think that info is available in the sysvol but maybe someone else will say otherwise.

FIRST: I would try to take your P2V drive and create a VM based on it and get the VM up even if it's off network. It would be much easier to see what the GPOs really were.

SECOND...IF YOU CAN'T:

  1. Create a new "test GPO" in the GPMC
  2. Make note of the new "test GPO"'s guid in its properties
  3. go to the sysvol/domain/policies folder and into the new GPO GUID folder
  4. copy/paste the old Machine, User and GPT subfolders from the original P2V drive under one of the GPO's in that drive into the new GPO GUID folder, overwriting the new Machine, User, and GPT folders.
  5. Edit the new GPO, browse to any unconfigured policy setting and open it and set and unset the setting. This is because the settings won't be shown if you don't change something.
  6. Do the same with any "preference" in the GPO, then close the GPO.
  7. You will have to manually set the security permissions and scope and filters again.
  8. I would suggest taking note of those settings and then editing a brand new GPO to mimic those settings you see in the "restored' GPO. It would be cleaner that way, then when you have all of the restored GPOs and their settings CLONED then you can delete the "test/restore" ones.

Hope that helps. It's going to be a lot of manual work, but at least you'll see the settings and can somehow recreate them.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.