1. Does AGPMMig.exe leave the policy in the current state in AGPM so that we can test in parallel?
2. Does AGPMMig.exe mark deprecated settings during the process so that we can clean up our GPOs during the migration ?
3. AGPMMig.exe per documentation should migrate the whole GPO history. Does it mean that we can roll back to whatever point in time from AGPM history when migrated?
For the SQL database, we want to know if the configuration database contains any sensitive or privileged information (like passwords, etc). That will determine if we use a shared SQL server or a separate dedicated one.
1. Does AGPMMig.exe leave the policy in the current state in AGPM so that we can test in parallel?
ANS: The migration is non-destructive so the AGPM items are left in their last state. Note however if you tests in parallel any changes in AGPM will not appear in GPOADmin as the items have already been migrated, and this will trigger non-compliant changes in GPOADmin as they are editing the policies outside of GPOADmin.
2. Does AGPMMig.exe mark deprecated settings during the process so that we can clean up our GPOs during the migration ?
ANS: We do not review the GPO settings at all during the migration, it simply migrates the policies as they are.
3. AGPMMig.exe per documentation should migrate the whole GPO history. Does it mean that we can roll back to whatever point in time from AGPM history when migrated?
ANS: So long as backups exist for the historical items and they migrate correctly you should be able to roll back in GPOADmin. If you migrates and later removes any of the backups from the GPOADmin backup store they will not be able to roll back to any versions where the backups have been removed, same as with any GPO registered in GPOADmin.
For the SQL database, we want to know if the configuration database contains any sensitive or privileged information (like passwords, etc). That will determine if we use a shared SQL server or a separate dedicated one.
ANS: We do not store any unencrypted password information in our database. We will store information on the usernames / SIDs of trustees who can use GPOADmin however this is readable information in AD.
