1
00:00:03,060 --> 00:00:03,870
Okay.

2
00:00:04,800 --> 00:00:10,500
In this module, I'm going to talk about some of the group policy management tasks that you can perform

3
00:00:10,500 --> 00:00:12,570
against your group policy environment.

4
00:00:13,530 --> 00:00:17,250
And really most of these are going to come out of the AMC.

5
00:00:18,180 --> 00:00:23,370
And what I wanted to do now that we've talked about kind of basics and some scenarios around using group

6
00:00:23,370 --> 00:00:24,000
policy.

7
00:00:24,120 --> 00:00:29,430
I wanted to dive into more aspects around management and troubleshooting in this last few modules.

8
00:00:30,420 --> 00:00:32,340
So let's go ahead and dig in.

9
00:00:33,330 --> 00:00:38,700
So there's a set of operations that you're going to want to perform against your group policy objects

10
00:00:38,700 --> 00:00:40,170
on an ongoing basis.

11
00:00:41,160 --> 00:00:46,860
And and this goes beyond just the basic stuff that I've talked about in creating new GPOs and editing

12
00:00:46,860 --> 00:00:49,540
them and linking them and all that sort of stuff.

13
00:00:50,570 --> 00:00:56,270
So there's group policy backup and restore, which is kind of one of those hygiene items that you always

14
00:00:56,270 --> 00:00:58,340
want to be doing within your environment.

15
00:00:59,320 --> 00:01:04,450
Can't tell you how many times I've seen situations where users weren't backing up their group policy

16
00:01:04,450 --> 00:01:08,950
objects and then got into a pinch where they made a change that they couldn't restore.

17
00:01:09,900 --> 00:01:11,790
Or they deleted a GPO.

18
00:01:12,030 --> 00:01:14,970
And without that backup, you're just kind of out of the water.

19
00:01:15,970 --> 00:01:16,480
There.

20
00:01:16,480 --> 00:01:21,850
There is a way if you backed up your Active Directory, there is a way to get a GPO backups through

21
00:01:21,850 --> 00:01:23,370
a system state restore.

22
00:01:23,380 --> 00:01:24,820
But it's really painful.

23
00:01:25,810 --> 00:01:31,840
The other aspect that I want to talk about is delegation of the various group policy management tasks.

24
00:01:32,810 --> 00:01:36,470
And group policy has a reasonably rich delegation model.

25
00:01:37,480 --> 00:01:41,410
So I'm going to go into that and talk a little bit about how that works.

26
00:01:42,380 --> 00:01:44,960
And then finally, group policy import.

27
00:01:45,950 --> 00:01:51,050
This is a little bit different from the backup and restore function and I'll talk about how it's different,

28
00:01:51,260 --> 00:01:56,240
but this gives you a number of other scenarios that you can use to take advantage of your backups to

29
00:01:56,240 --> 00:02:01,250
bring in GPOs from other domains or restore other GPOs that have been deleted.

30
00:02:02,230 --> 00:02:05,380
So let's look at backup and rest all to start with.

31
00:02:06,390 --> 00:02:10,290
So GPIO backups can be created in PMC.

32
00:02:11,220 --> 00:02:16,920
And in the last module in this course, I'm going to talk about using PowerShell to manage group policy.

33
00:02:17,850 --> 00:02:21,270
And I'll get into the way you can do backups using PowerShell.

34
00:02:22,240 --> 00:02:27,250
But for the time being, we're going to talk about doing it in the context of GMC.

35
00:02:28,200 --> 00:02:33,840
And you can do backup of a single GPO, or there's a function where you can do a backup of all GPOs.

36
00:02:33,840 --> 00:02:39,660
And I typically recommend folks if you haven't backed up your GPOs before to run the all GPO backup

37
00:02:39,660 --> 00:02:41,180
first and get a baseline.

38
00:02:42,080 --> 00:02:47,390
And then as you make changes over time, you can do one off backups of GPOs that change.

39
00:02:48,360 --> 00:02:50,640
GPOs are used to roll back.

40
00:02:51,640 --> 00:02:55,810
GPIO backups are used for rolling back existing GPOs.

41
00:02:55,840 --> 00:02:57,250
So that's the use case.

42
00:02:58,210 --> 00:03:01,120
And there's a restore function that you can get access to.

43
00:03:01,150 --> 00:03:07,120
So if you make a change to a GPO and you want to roll back that change you can restore from a backup.

44
00:03:08,070 --> 00:03:14,820
Backups are not there to restore a deleted GPO so that you might think that are you know, you make

45
00:03:14,820 --> 00:03:17,300
a backup of a GPO and you delete it.

46
00:03:17,310 --> 00:03:18,360
I can restore it.

47
00:03:19,310 --> 00:03:25,070
Well, the restore function, the back up is good for getting back to a known good state, but the restore

48
00:03:25,070 --> 00:03:28,670
function is not usable in the deleted scenario.

49
00:03:29,610 --> 00:03:33,300
So that's the job of the import function, and I'll talk about that.

50
00:03:34,280 --> 00:03:36,980
Backups themselves are stored in the file system.

51
00:03:36,980 --> 00:03:39,170
And I'll I'll show you what that looks like.

52
00:03:39,170 --> 00:03:42,710
And it's underneath whatever folder you select to store the backups.

53
00:03:43,680 --> 00:03:50,340
You can just specify a unique path or a local path on your workstation where you or you're doing PMC

54
00:03:50,340 --> 00:03:51,000
management.

55
00:03:52,010 --> 00:03:55,340
I typically recommend having a backup of your backups.

56
00:03:56,330 --> 00:04:01,340
So make sure that your backups are stored on some location that gets backed up so that you don't make

57
00:04:01,340 --> 00:04:03,980
your backups and then have your hard drive crash.

58
00:04:04,970 --> 00:04:07,640
And and no longer have access to them.

59
00:04:08,550 --> 00:04:14,910
And then they can be viewed and deleted from the manage back UPS dialogue, which is what I have in

60
00:04:14,910 --> 00:04:16,200
this screenshot here.

61
00:04:17,140 --> 00:04:22,900
And this is just showing you some backups that I did on this downloads folder under my user profile.

62
00:04:23,820 --> 00:04:27,870
And I've got, you know, three different GPOs that have been backed up.

63
00:04:28,790 --> 00:04:34,040
And the folder where the backups are kept is shown at the top and you can change that folder if you

64
00:04:34,040 --> 00:04:36,290
keep backups in different locations.

65
00:04:37,250 --> 00:04:43,430
The list of all the backed up GPOs are shown with their timestamp and their ID and the name of the GPO.

66
00:04:44,320 --> 00:04:48,460
And you can you can put a description on a backup when you make the backup.

67
00:04:48,670 --> 00:04:51,310
So that's what's shown here in that description column.

68
00:04:52,230 --> 00:04:57,900
You can view the settings in the backup, so you can click on a backup and click the View Settings button

69
00:04:58,110 --> 00:05:01,200
and it'll actually show you the settings that have been backed up.

70
00:05:02,180 --> 00:05:07,820
So that's a good way of seeing, you know, what the backup is that you're potentially going to restore.

71
00:05:08,800 --> 00:05:12,040
You can delete a backup so you can use this dialogue.

72
00:05:12,040 --> 00:05:16,810
If you have backups that are no longer valid or they're too old, you can delete them from here.

73
00:05:17,760 --> 00:05:23,130
And you can use the restore button to actually perform the restore against your live GPO.

74
00:05:24,030 --> 00:05:30,030
You can also do this from the GPO itself, but from the managed backups UI, you're able to do that.