Okay.
I'm going to look at two scenarios that use the import feature.
The first is the scenario of the deleted GPO.
You'll remember from earlier in this module, I created this kiosk user settings GPO.
And made a back up of it and showed you how you can use backup and restore to roll back the settings
in the GPO once they've changed.
I'm going to go ahead and delete the GPO now.
So kiosk user settings is going to go away.
And I'm going to come back in here and I'm going to create a new GPO because, hey, I really want kiosk
users settings back in my domain.
So I'm going to go ahead and create a new GPO called Kiosk User Settings, and I'm going to click.
Okay.
And now that that new GPO is there, you'll see it's got no version number, which means there's no
settings in it at all.
I'm going to go ahead and say import settings.
And I'm going to run through the import wizard.
And it lets me, if I want to, I can back up this GPL.
Because essentially what import is going to do is completely wipe out the existing GPO and rewrite it
with the settings that are in the backup.
Well, since there's no settings in this GPO because I just created it, I don't need to back it up.
I can tell it the backup folder where my backup exists.
And if I go into the backup folder, I'll see all of my backups.
And here's my kiosk user settings back up.
So now I'm going to go ahead and click next.
And lo and behold, my GPO is now restored.
You'll notice the user version and the computer version increment.
So I've got I can prove that my GPO has been restored.
What's interesting is that I don't get the original grid of the GPO or unique ID of the GPO back.
I still have the good of the new GPO.
The other thing to note is that when you delete a GPO.
Any containers or use domains or sites that that GPO is linked to, those links are removed.
So even though I've recreated the GPO and restored it from a backup using import, none of the links
that were in place for this GPO are there.
So you're going to have to recreate those links manually.
But let's go in and look at the settings report.
And you'll see that.
Sure enough, all of my settings that were in that original kiosk user settings, GPO are back.
So I've essentially used import to recreate this policy.
And that's a key feature of the import function.
Now what I want to do is show you the use of an import for bringing a GPO from one domain to the other.
So I'm going to go ahead and create a new GPO and I'm going to call it user rights policy.
And I'll show you why in a second.
This user rights policy is going to get created.
Now what I want to do is I want to go up to the group policy objects container right click and say Open
Migration Table Editor.
And now I've got a new migration table.
Remember I talked about migration tables as the thing that you can use to map basically security principles
and USC paths.
From a backup.
A GPIO backup or even a life GPIO from one domain to the other.
And what I'm going to do is I'm going to say populate from back up.
And I'm going to point out that a GPO that I've got from a foreign domain.
We'll call this my test domain at sea panel icon.
I'm going to go ahead and point at that GPO.
And I'm going to say.
Okay.
And now what it does is it identifies all of the security principles in that source GPO and lets me
not them.
And actually what I want to do is I want to do that again.
And I want to show you some other option.
You'll see this option down here that says during scan includes security principles from the decal on
the GPO.
The decal is the security filter on the GPO.
So that's the delegation that's in place on that GPO.
And you can translate or migrate those security principles.
Just as easily as those groups or security principles that exist within settings inside the GPO.
So I'm going to go ahead and include those.
And you'll notice that my list suddenly got a lot longer.
So when you'll notice that now groups like Enterprise and Domain Admins, GPO admins.
All have come across as being part of that backup.
Now what I want to do is I want to map these for the destination domain.
So I'm going to right click in this destination domain cell.
And I have three options.
I can either say no destination, which means that it's not.
It's just going to drop that security principle.
Wherever it exists when it's bringing the GPO back up over.
Not by relative name, which means leave out the domain part of that.
And just translate from in this case, enterprise admins at C Pond.
Welcome to enterprise admins that are to test TLD, which is what I'm going to do.
And I can do that.
The same for the Domain Admins group because it exists in my destination domain.
And same as sauce for everyone.
For marketing users.
I'm going to go ahead and say map by relative name because I'll have a marketing user's name and my
destination domain.
Now I don't have a GPO admins group in my destination domain, so I'm going to say no destination.
In other words, drop that group from the GPO as I bring it over.
Administrators, same as source.
Sales users, I'm going to say map by relative name and authenticated users, same as source.
So now I've got my migration table.
I'm going to go ahead and save that migration table.
And I'll go ahead and save it as user rights and it gets saved with a dot m i g table extension.
Saved it in my documents folder.
And now let's go back to that user rights GPO that I just created.
And I'm going to say import.
Click next.
Click next again.
Click next into the back up.
And go down to my user rights back up.
And I can, you know, view settings on this to see what settings are in this GPO.
And you'll notice I have a bunch of user rights assignments and there are those groups that you saw
the migration table pick up on.
And if I go into delegation, you'll see this is why it picked up on domain admins, enterprise admins,
GPO admins, etc..
So I've got that GPO, that backup that I'm interested in.
I'm going to click next.
And it's going to scan for security principles.
And you'll get it, says the backup references to security principals and or USC paths specify how they
should transfer.
So I'm going to click next and I'm going to say, use the migration table.
And it found my migration table.
But I just created.
You can browse to another one if you want.
It also gives you the option to say use the migration table exclusively.
So if any security principles or U.N. paths are not found in the migration table, do not perform the
import.
In other words, just stop the import.
We don't want to do that.
We're just going to go ahead and drop those principles that we don't map.
And I'm going to go ahead and click Finish.
And it succeeded in bringing in that new GPO or that backup from my other domain into the user rights
policy.
And now you'll see under local rights.
User local policies, user rights assignment that had mapped the C panel marketing users and C panel
sales users to the user to test domain.
So it made that change.
And if I look at delegation, you'll see that it picked up domain admins and enterprise admins and authenticated
users just fine as well.
So all of the security principles have essentially been migrated from the test domain to this new production
domain.