GPOs and migrating between servers

[Guest Guest]

We have just about finished moving over all of our servers to a virtual environment. Whilst doing this i took the oppertunity to rebuild all the servers from scratch rather than P2V them and taking any problem with them.

 

Im just doing the app server now which contains all the software which is installed by GPO and script. Obviously all the GPOs and also my scripts point to OldServer.domain.local, but now i need them to point to NewServer.domain.local.

 

Is there an easy way of doing this for GPOs? Obviously my scripts can be fixed with a find and replace, but what about GPOs? How sensitive are they to manual editting? Can i find the UID of the GPO, find the folder and edit the files? The files seem to be code and plain text, so it is possible, but will it work?

 

 

I was wondering if a DNS alias would work but no joy there as it knows its not the correct computer...

 

 

//Solution in post 10 http://www.edugeek.net/forums/windows-server-2000-2003/40686-gpos-migrating-between-servers.html#post377589

Edited September 2, 2009 by Guest

[PiqueABoo]

I would try: GPMC export your old GPO, then GPMC import it using a *migration table* to map old to new UNCs and anything else you need migrating (e.g security principals).

[Guest Guest]

For reference;

 

GPMC MTE (Migration Table Editor) seems to do the job. It allows you to do a find and replace type jobby with everything* in your GPOs.

 

To access it go into GPMC and right click the "Domains" object.

 

* I say everything; it will do computers, users, UNC paths etc, but ill get back if theres anything which i have a problem with.

[Guest Guest]

I would try: GPMC export your old GPO, then GPMC import it using a *migration table* to map old to new UNCs and anything else you need migrating (e.g security principals).

 

Cheers, was just posting lol

[ZeroHour]

V useful to know (to the both of you ) as I am going to have to face the pain of moving all the GP deployed msi's.

Out of interest did your clients do anything when they got the new gpo such as reinstall?

[cookie_monster]

I've just been through this myself and after reading that sometimes the apps end up reinstalling probably due to the time stamp of the GPO changing I just went for the reinstall option but i've used a DFS share this time so in future I can easily move the apps to another server. I'd recommend looking into that.

 

Using DFS for Software Installation - O'Reilly Media

Edited September 2, 2009 by cookie_monster

[Guest Guest]

^ Good call. I had read about DFS for software deployment a while back and thought at the time that it would save alot of hastle in the future. Shame i had forgot eh!

 

Just starting to impliment the changes now but am having a time out and a good read before clicking the OK button, so you caught me just in time

[Crispin]

This is very useful for me too as I was very near to having to edit 320 UNC paths (Start Menu and Desktop Redirection) so this will be a real timesaver!

 

Trying to get DFS working as well, however ran into trouble with replication beetween 2k servers and 2008. Will have to set it up once we've demoted and removed the 2k servers.

[PiqueABoo]

I say everything

 

Haven't ever done s/w deployment GPOs, but otherwise the things I couldn't make it migrate:

 

1) IE trusted zone policy ("zonemaps" - I had some local UNC paths in the trusted zone)

2) Any Server 2008 Group Policy Preferences.

Edited September 2, 2009 by PiqueABoo

[Guest Guest]

Well it would seem to be working

 

The Migration table Editor had me abit stuped there; maybe as i was expecting it be more of a GPO editor (which it is not), maybe because its 9pm and my head is fried!

 

 

This is a basic overview of how it works (atleast for my situation, and i guess most other people reading this)

 

The editor is a means to create a "Find and replace" file for GPOs, not to edit them directly. This file will be used later to change the existing GPOs (or ones copied from a test domain to the production domain, as his is what the tool was really designed for).

 

Open GPMC and right click Group Policy Objects (at the bottom).

 

Back up all - and choose an appropriate folder

 

Now go and take a copy of that folder and put it somewhere safe (This will be your backup, we will be using the original "backup" for something else)

 

Now right click on domains in GPMC and open Migration table editor

 

You can now use the "Tools - Populate from GPO" to see an example of the data contained in a GPO. Notice the middle field, in my case UNC path.

 

Now that you've seen how its layed out close MTE and reopen it (otherwise we'll end up with empty fields in the table, and MTE doesnt like this)

 

Fill in the table, for example i wanted to move the share "\\serverold\msi$\...." to "\\servernew\msi$\...."

So i entered;

\\serverold\msi$  ¦  UNC path  ¦  \\servernew\msi$

 

Tools - validate. Correct as nessissery.

Save.

 

Now we have the "Find and replace" file. Now to apply it to the GPOs.

 

 

Goto %programfiles%\gpmc\scripts\ and have a look for the ImportAllGPO.wsf script This script will only run with cscript from cmd.

 

Now the idea here is that we are going to import our backup GPOs right over the top of our existing ones, modifying them in the process (bit strange i know but...)

 

Open cmd and use the syntax

 

cscript importallgpos.wsf  n:\gpobackuplocation /migrationtable:"n:\migrationtable.migtable"

 

Press enter and watch and smile as it wizzes through all your GPOs

 

 

More info can be found here the last few paragraghs being the most relelant in this case

Deployment Examples: Group Policy

Edited September 2, 2009 by Guest