Old IT Company has edited the Default Domain Policy

[abillybob]

Hi All

 

So I presume I'm scuppered? Just discovered that the old IT company here has editted the Default Domain policy with all sorts of strange settings.

 

Is there anyway I can return this back to its default self? I think this is why I'm getting weird issues across the network but at the same time worried about changing it as I'm not sure what it will break!

 

There's a lot of strange GP settings added onto here! *Sigh*

[Katy]

Run dcgpofix. This resets the default domain and default DC policies to default.

[abillybob]

Run dcgpofix. This resets the default domain and default DC policies to default.

 

Thank you for your help. It says running this would reset all Group Policy to how it was after AD was installed. I'm a bit worried whether this will delete the other group policies I have on the domain?

[fiza]

The description on the MS website page for dcgpofix it says it will;

 

Restore the Default Domain Policy GPO to its original state. You will lose any changes that you have made to this GPO

[Katy]

Thank you for your help. It says running this would reset all Group Policy to how it was after AD was installed. I'm a bit worried whether this will delete the other group policies I have on the domain?

Where does it say that? I presume you're planning to take a backup of all your GPOs beforehand anyway.

 

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/dcgpofix

 

You specify either domain or DC as the target, to reset the default *domain* policy or default *domain controllers* policy (or both to do both of them)

 

PS C:\Windows\system32> dcgpofix /?
Microsoft(R) Windows(R) Operating System Default Group Policy Restore Utility v5.1
Copyright (C) Microsoft Corporation. 1981-2003

Description: Recreates the Default Group Policy Objects (GPOs) for a domain

Syntax: DcGPOFix [/ignoreschema] [/Target: Domain | DC | BOTH]
/target: {Domain | DC | BOTH}

Optional.  Specifies the GPO to be restored: the Default Domain Policy GPO, the Default Domain Controllers Policy GPO, o
r both.
/ignoreschema:
Optional. Use this switch to enable this tool to ignore the schema version of  Active Directory. Otherwise, this tool wi
ll only work on the same AD schema version as the Windows version in which the tool was shipped.

[Chuckster]

Running the DCGPOFIX will only recreate either the default domain policy GPO, the default domain controllers policy GPO or both. It will leave all other GPOs alone and intact.

 

A typical command could look like this:

 

Repair Default Domain Policy

dcgpofix /target:domain

 

Default Domain Controllers Policy

dcgpofix /target:DC

 

For both GPOs

dcgpofix /target:both

 

 

I had to do this last year when the default domain policy became corrupted.

[RobD]

You could:

Backup all the GPOs to a file store,

Note the GUID of the default domain policy and remove it from the file store,

Run dcgpofix

Restore the GPOs.

[abillybob]

Thanks all much love and help!! I'll give that a go tonight once everyone is off the system.

[Jawloms]

I'm sure mine has a few things set in it which it shouldn't. Does anyone know where I can find what the default domain and default domain controller policies should have in by default? If not, could someone export theirs and upload it somewhere?

 

Thank you

 

Stuart

[RobD]

I saw them listed here, cant guarentee they're acurate though:

 

http://www.sysadminlab.net/windows/restore-default-domain-policy-and-default-domain-controller-gpo-settings-to-default