Migrating Group Policy

Migrating group policies from one domain to another in a forest, or from one forest to another isn’t as straightforward as it might initially seem.

To the uninitiated, all that it might seem you need to do is export a group policy from the group policy management console in the source domain and then import the group policy in the destination domain. That may work for very basic policies, but if your policies have WMI filters, you want to retain links to specific OUs, you have logon scripts referenced or embedded credentials – then you’ll need to use something a little more sophisticated.

A post on by Ashley McGlone, an Active Directory Premier Field Engineer explains how you can migrate group policy objects, with all the associated parts, using Windows PowerShell. McGlone has published a script in the TechNet script center that works around some of the limitations of the group policy related Windows PowerShell cmdlets and allows export and import of Group Policy Objects across Active Directory environments.

There are some caveats. You’ll need a DC running Server 2008 R2 in your environment, so you’ll have to do a partial upgrade of your source forest to migrate GPOs across (though you won’t have to upgrade your functional level, you just need to use that 2008 R2 DC to perform the export operation)

You can read McGlone’s post in full here, which will walk you through the process of using the script he created.