Group Policy Links Backup and Restore functions
Updated on 2/20/2014:
restore-gplink function was updated to incorporate cases that were not included at first.
===================================
Hi
A few months back, I put together a function that allowed me to collect the GPLinks information on targeted OUs and sites.
In the post it was also explained how you could run that function on an OU structure to create a global GPlink backup file.
Only I recently thought that I would be more useful to be able to target a GPO and backup the location of where it is linked.
And of course once you have the backup you will want to be able to restore it.
Dependencies:
Those new functions (at least the backup one) will need you to use the “get-gplink” function I have created.
The main reason is the format that I have used to export information on the status of the links.
As you can see, I return the values as “yes” and “no”.
Using the get-gpinheritance it returns “True” and “False”
The problem is that the cmdlet “new-gplink” or “set-gplink” , when it comes to the switches, expects a value of “yes” and “no”
So because I do not want to have to manipulate those ouputs, I simply use my function.
By the way, this was why I set the output of my function to use “yes” and “no” from the start.
Backup-gplink function
The best way I know of getting where a GPO is linked (besides using GPMC) is to look at a GPO report.
With Powershell you can get that report with a simple line:
What we are interested in is the “links” part of the report as it contains the information we are looking for. Be careful as it only includes the links of the GPO in its own domain.
Now HTML is fine for viewing but not for parsing.
We can change the output of the get-gpreport to export in xml and we can even load that output into a variable.
The [xml] at the beginning of the line is to declare the type of the variable $xml. Basically we have declared that the content of the variable is in xml format.
Now what can we do with that variable… Well navigate its content of course.
We now have a format that we can manipulate and we have almost all the information we need, we are only missing the link order… and that is a shame.
That is where we need to use the get-gpink to collect that information.
So out of that report I am only interested in the SOMPath that will contain all the locations where the GPO is linked.
Once you have registered the functions by “dotnetting” the script I have provide, you will be able to use the function “Backup-gplink”.
The function has two parameters:
Gponame: the name of the GPO you want to backup the gplinks
path: path to where you want to save the backup file. (in this example the variable $pwd indicate the location of my prompt “C:\Users\Administrator\Documents” )
The output is a simple csv file, name <gponame>_gplinksbackup.csv that you can later see and manipulate.
Restore-gplink
Once you have that backup, you might want to use it to restore a gpo gplinks.
That function is very simple and has only one input and a switch
It will consume the content of the CSV file and use either the cmdlet “new-gplink” to link the GPO to the location where they were previously linked or if already linked “set-gplink” to re-apply
the configuration that was in the backup (in case it was changed).
So you have your GPO linked:
After an error (human or else..) the links are gone:
Run the above command
The links will be restored but with a disabled state. The idea is to prevent restoring a GPO link that would impact the production.
You will manually have to enable the link again to make it effective.
The script will change the link order from the one in the backup if there is not the same number of links on the SOM or if the retsored gplink is the only one and add an order different then 1 in the backup.
If the GPO is still linked at the same location the script will not by default, chnage tha value of the link
However if you want to force the values that are in the backup file, you can use the -force switch:
Backupgpofull
Here is a quick and dirty way of planning a daily backup of your GPOs with their GPLinks. This script will remove content that is older than a day and do a backup of the GPO
and the GPOs Links.
get-childitem -Path $pwd\bck | where-object {$_.LastAccessTime -le (get-date).adddays(-1)} |foreach { Remove-Item -Path $pwd\bck\$_ -force -Recurse}
get-gpo -all | foreach {
Backup-GPO -name $_.displayname -Path $pwd\bck
backup-gplink -gponame $_.displayname -path $pwd\bck
}
Restoregpofull
Based on that output you could use the following code to restore your backup and their gplinks
$directories=Get-ChildItem -Path $pwd\bck -Directory
$files=Get-ChildItem -Path $pwd\bck -File
foreach ($d in $directories)
{
Restore-GPO -BackupId $d.name -Path $pwd\bck
}
foreach ($f in $files)
{
restore-gplink -path $pwd\bck\$($f.Name)
As usual hope you find this useful in your daily work and please give we feedback on this.
Script can be found here