How to Backup and Copy Local Group Policy Settings to Another Computer

Group Policies are used to centrally configure settings for computers and users in Windows. If your computers are joined to a Windows domain, you can use domain GPOs to bring all the computers within an Active Directory domain into a single configuration. If you do not have a domain, you can use the local Group Policy to configure the settings for a single computer (the local Group Policy Editor is started with the gpedit.msc command). In this article, we’ll show you how to back up a local GPO and copy the local policy settings to other computers.

If your network is based on a Windows workgroup, you can use local Group Policy to get all of your computers to have the same configuration. To do this, you need to configure local GPO options on the reference computer, and then copy and apply these settings to other computers.

How to Manually Copy Local GPO Settings to Another Computer

There are no built-in tools in Windows to back up, import, export, or migrate local GPO settings.  Windows stores local Group Policy administrative template settings in Registry.pol files under the following paths:

• %SystemRoot%\System32\GroupPolicy\Machine\
• %SystemRoot%\System32\GroupPolicy\User\

Therefore, the easiest way to transfer local Group Policy settings between computers is to manually copy and replace the contents of the %systemroot%\System32\GroupPolicy folder from one computer to another. You must manually update the Group Policy settings with the gpupdate /force command or restart Windows after replacing the GPO files.

Main drawbacks of this GPO migration method:

1. Settings from local Security Templates are not copied;
2. Errors may occur when applying the GPO if the version of Windows on the target computer is different;
3. You cannot import local GPO settings into the domain Group Policy Management Console (gpmc.msc);
4. There are some issues with the migration of settings from custom ADMX templates.

How to Backup (Export) Local Group Policy with LGPO.exe

Microsoft recommends the use of the LGPO.exe console tool for the backup/import/export and transfer of local Group Policy settings. LGPO (current version 3.0) is included in the Microsoft Security Compliance Toolkit and is available to download here https://www.microsoft.com/en-us/download/details.aspx?id=55319.

The LGPO.exe utility allows you to:

• Export local group policy settings to files;
• Import GPO settings from the backup. Allows to import registry.pol files, security templates, and CSV files;
• Convert registry.pol files to readable LGPO format and vice versa.

To backup (export) the current local GPO settings to the specified directory, use the command:

LGPO.exe /b c:\tools\GPO

The tool saves the local policy settings in a folder with a random GUID name.  This directory contains all of the necessary files that are required to restore the local GPO settings or to apply them to a different computer.

To conveniently view the current GPO settings in the registry.pol file, run the following command:

lgpo.exe /parse /m "C:\Tools\GPO\{985966AD-21BE-4A9C-BF7D-26C879982067}\DomainSysvol\GPO\Machine\registry.pol" >>c:\tools\gpo\lgpo.txt

The target lgpo.txt text file contains the registry settings that are applied by this policy.

You can manually edit the lgpo.txt file and convert it to the registry.pol format:

LGPO.exe /r "C:\tools\GPO\lgpo.txt" /w "C:\tools\GPO\registry_new.pol​"

To apply the new settings from the registry_new.pol file to the computer’s current local policy:

LGPO.exe /m "C:\tools\GPO\registry_new.pol​"

Import (Restore) Local Group Policy Settings on Windows

To import (restore) local GPO settings from a backup on another computer, you must copy the Policy GUID directory to the target computer and run the command:

LGPO.exe /g C:\tools\GPO\

Some administrators use Multiple Local Group Policies (MLGPO) to apply individual local  GPO settings only to specific groups (non-administrators or administrators) or users. By default, the lgpo.exe doesn’t export the MLGPO settings.

The next thing we’ll look at is how to copy the MLGPO settings for specific users or groups to other computers.

When an administrator creates a new Local Policy for a specific local user or group (MLGPO), a separate folder is created for that GPO in the C:\Windows\System32\GroupPolicyUsers directory. The SID of the user or group is used as the directory name. For example:

• S-1-5-32-545 – non-administrators (BUILTIN\USERS)
• S-1-5-32-544 –administrators (BUILTIN\ADMINISTRATORS)

For example, you might want to copy the settings of the local GPO for non-administrators to another computer.

• From the reference computer, copy the Local Policy Settings file from the directory with the required SID ( C:\Windows\System32\GroupPolicyUsers\S-1-5-32-545\User\Registry.pol );
• In order to apply the Registry.pol file for non-administrators on the target computer, run the following command:lgpo /un "C:\tmp\Registry.pol"

Import MLGPO settings for Non-Administrators from registry.pol

Export and Import Group Policy Settings with LocalGPO

Previously, the LocalGPO script (part of Microsoft Security Compliance Manager 3.0) was used to import and export the local Group Policy configuration. The LocalGPO tool allows you to quickly create a backup copy of a local GPO and restore local policy settings from it. It also has an interesting option to create a GPOPack executable file that allows you to migrate (import) local GPO settings to another machine with a single click.

To export local Group Policy settings to the C:\GPObackup directory (the target folder must be created in advance):
cscript LocalGPO.wsf /Path:C:\GPObackup /Export

The LocalGPO utility allows you to export MLGPO settings for a specific group or user to a separate directory. Syntax used:

cscript LocalGPO.wsf /Path:C:\GPObackup /Export /MLGPO:Administrators
or
cscript LocalGPO.wsf /Path:C:\GPObackup /Export /MLGPO:LocalUserName

To restore local Group Policy settings from a previous backup copy:

cscript LocalGPO.wsf /Path:C:\GPObackup\{B6542366-C0C0-4948-AF39-B17F0B1F0E9A}

LocalGPO allows you to reset all current local Group Policy settings to the default:

cscript LocalGPO.wsf /Restore