Chat now with support
Chat with Support

GPOADmin 5.19 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Working with GPO synchronizations

Keep the following in mind when working with synchronizations:

•
To synchronize during an immediate deployment (a non-scheduled deployment), the user deploying the GPO must have the Synchronize right.
•
The target settings will be overwritten with the settings from the source.
•
If a synchronization is attempted while a target GPO is checked out, the synchronization will fail.
•
If a target is off line, the synchronization will fail.
•
If the source GPO is out of compliance and either a ‘Rollback’ or ‘Incorporate Live’ compliance action will trigger a synchronization.
•
Communicate synchronizations plans to those responsible for GPO administration in other domains.
•
If GPO synchronization is enabled on a targeted GPOADmin server, ensure that the target GPO does not have the source GPO set as a synchronization target. Doing so will place the two GPOs in an endless synchronization loop.
•
When changing the service account, any existing GPO synchronization configuration should be reconfigured to ensure the proper password is used to connect to the target GPOADmin server.
•
All configuration options are available through menu options, right-click context menus, and the editor’s toolbar.
•
Selecting File | Exit closes the Synchronization Editor.
•
Select Edit | Select All allows you to select all the GPO targets listed in the editor.
To set up synchronization
1
In the Version Control Root, right-click the source GPO, and select Synchronize | Set Synchronization Targets.
This will open a dialog where you can add GPO targets and configure their synchronization settings. By default, the server that you are currently connected to will be displayed. It cannot be removed.
2
If required, select Add Servers to include other servers that contain the GPOs that you want to target. Select the server and click Connect. Enter the required credentials and click OK.
* 
NOTE: The credential entered will be stored and used to connect to the associated server during the synchronization process.This allows for the synchronization of GPOs between untrusted domains.
You can also select to remove any servers that have been added. If you do however, any target GPOs setup from this server for synchronization will also be removed.
3
Select the required GPOs and choose Synchronization | Add Synchronization Target to select the required target GPOs. The list of all available GPOs will display.
4
Select the required targets and click OK.
5
If required, we provide the option to setup a migration table by selecting the target and choosing Synchronization | Select Migration Table. From here, you can add (or remove), create, modify the migration tables that are going to be used during the synchronization using the Microsoft Migration Table Editor.
The migration tables, which are xml files, contain the mapping between the source and the target accounts to ensure they have the same access. If permissions are not an issue, the migration table would not be required. It is stored in C:\Program Files\Quest\GPOADmin\MigrationTables.
You are now ready to set the synchronization options.
6
Select the target and choose Synchronization to set the synchronization options. You can choose between the following:
•
Clear Migration table: Clear the tables when no longer required.
•
Use Migration Table Exclusively: If enabled, the migration (import operation) will not proceed if any settings security principals or UNC paths configured within the source GPO do not exist in the migration table.
•
Migrate Security Filters: Migrates any security principals from the security filter that are found in the migration table.
•
Set target WMI Filters: Select this option to synchronize WMI filters between domains. You can choose between the following options:
•
None: When you select this option, the WMI filter in the target GPO will not be updated. Use this option to disable previously set WMI Filter synchronizations.
•
Auto-map By Name: When you select this option, if a WMI Filter in the target domain is found with the same name as the WMI Filter linked to the source GPO, it is assigned to the target GPO.
•
Select WMI Filter: This opens a browser that lists all of the WMI Filters in the target domain where the connected account has access. From this list, select the WMI Filter to assign to the target GPO.
•
Target State: Select the state that you want the target to be in after the synchronization completes. You can choose between Available, Checked Out, Pending Approval, or Deployed. The default is Checked Out.
* 
NOTE: If a target state of Deployed is to be used, it is recommended that this account is a member of the GPOADmin Administrators as they are the only ones who can Approve multiple times.
•
Set Target Workflow Delay: Select this option to specify the amount of time to wait between workflow actions. By default, this is set to 0.
•
Synchronize Deletions: Select to enable this option, if you want any deleted source GPOs to also be deleted in the target.
7
Once you have your targets set, it is recommended to validate the synchronization targets by selecting the target GPO and clicking Tools | Validate Synchronization Targets.
The synchronization targets are stored using their version control id and their display name. Over the course of time, the name may change or the object may be deleted. During the validation a connection to the target server is made and a check is performed to see if the synchronization target still exists or if the name has changed.
If there is an issue, the target will be displayed with warning icon and a tool-tip to inform you of the issue.
1
If you select to Cancel the editor, the warning will not persist.
2
If you select OK, the warning will remain to alert you that the issues must be addressed. When ready to address the issue, simply select the Correct button at the top of the dialog or right-click and select Correct.
To change the service account used to synchronize GPOs
1
In the Version Control Root, select the source GPO, and choose Synchronization | Set Synchronization Targets.
This opens a dialog that displays the GPO targets and their synchronization settings.
2
Select any one of the target GPOs, choose Tools | Update Credentials, and enter the new credentials.
To perform a manual synchronization
1
Right-click the source GPO and choose Synchronization | Synchronize Now.
This opens the Synchronization Progress dialog and allows you to perform a synchronization without redeploying the source GPO.
2
Select the GPOs to synchronize (or select all using Ctrl + A) and click Synchronize.
* 
NOTE: If nothing is selected, all items will be synchronized.
NOTE: You can also select a target and click the SynchSource header to select all the associated synchronization targets for that item.
The synchronization progress displays if the synchronization is pending, synchronizing, done, failed, or canceled.
* 
NOTE: If the synchronization fails, you can view the error by hovering over the faulted item. You can retry by selecting the Synchronize button again.
3
If required, you can select Export to export the data to a .csv file.
To validate the synchronization results
1
Right-click a GPO that has synchronization targets set and select Synchronize | Validate Synchronization Results.
OR
Right-click a GPO that has synchronization targets set and select Synchronize | Set Synchronization Targets. Then select one or more synchronization targets and choose Validate Synchronization Results.
The Difference report will run comparing each target to the last major version of the source GPO. Settings that do not match the source GPO are displayed as Out-Of-Sync. The Out-Of-Sync status remains until the settings are synchronized.
To retry the synchronization, right-click the out-of-sync targets and choose Synchronize Now.
To validate syncronization results for all synchronization targets
•
In the Version Control Root, select the source GPO, and choose Synchronization | Validate Synchronization Results.
This runs a comparison report comparing the last deployed version of the source GPO to each of the target GPOs. A warning icon is displayed on the tab of the targets that are out-of-sync.
To validate syncronization results for one ore more selected targets
1
In the Version Control Root, select the source GPO, and choose Synchronization | Validate Synchronization Results.
The Synchronization Target dialog displays the GPO targets and their synchronization settings.
2
Select one or more of the existing targets, and choose Tools| Validate Synchronize Results.
To synchronize to one or more individual targets from existing targets
1
In the Version Control Root, select the source GPO, and choose Synchronization | Set Synchronization Targets.
This opens the Synchronization Target dialog that displays the GPO targets and their synchronization settings.
2
Select one or more of the existing targets, and choose Synchronization | Synchronize Now.

Generating Synchronized GPO report

You can create a report that contains information on the GPO synchronizations that have been performed in your environment.

For details see the section Creating Diagnostic and Troubleshooting Reports .

Exporting and importing

•
Export objects
•
Exporting GPO registry settings as a Desired State Configuration resource file
•
Import objects

Export objects

Export objects

Using the Export Wizard, you can test objects offline before they are implemented in the live enterprise. A typical scenario would be to:

•
Check-out an object and make the desired changes.
Before you check in the change and request approval, you can test the edits.
•
Export the object to another domain and test the updates.
If you see an issue you can change it in the test domain.
•
Import the object.
•
Check in the new and improved changes for approval.
* 
NOTE: In the Pending Approval state, exporting the object provides an additional level of quality control before changes are made live in the enterprise.

The following built in roles can perform an export:

•
Moderator
•
System Administrator
•
User

Alternatively, you can create a custom role that includes Read and Export rights.

* 
NOTE: The exported objects must adhere to the naming conventions set on the destination container. Administrators can override this and move objects that do not comply; however, once moved the objects must adhere to the container naming conventions.
Migration table considerations
•
When migrating to an untrusted domain, the source entries must be SIDs and the Source Type must be set to Free Test or SID.
•
If migrating the Security Filter, the source entries (for the Security Filter only) must be in domain\account format. NT AUTHORITY accounts should have a Destination Name of <Same As Source>.
•
If an account cannot be mapped, it is logged in the format that GPMC is looking for.
•
If an entry is logged, change the source format to the format that is logged and try again.
To export objects to a test environment
1
Select the number of objects you want to export, either by using Ctrl + click to select multiple items, or Shift + click at the top and bottom of a contiguous series of items to select them all.
2
To export a single object, right-click the object.
3
Select Export.
* 
NOTE: If you are using the GPMC Extension, you can also select the GPO and click Workflow|Export.
4
Select the version that you want to export and click Next.
5
Select the target.
You can select a local directory or network share, another version control system, or a test domain in the live network.
To select a local directory or network share:
•
Select A backup on disk and click Next.
•
Select the backup directory and click Next.
•
Click Finish.
* 
NOTE: Select Compress to zip file to compress one policy to one zip file in the backup location. The file name will be in the following format: {GPOName}_{PolicyVersion}_{PolicyVCID}.zip.
To select another Version Control system
•
Select a Version Control Server and click Next.
•
Select a Target Folder and click Next.
•
Select a Version-Controlled Domain and click Next.
•
Select a migration table, if required, and click Next.
* 
NOTE: You also have the option to use the migration table exclusively and to migrate the security filter.
•
Click Finish.
To select a test domain in the live environment
•
Select The live environment and click Next.
•
Select the target domain and click Next.
•
Select a migration table, if required, and click Next.
* 
NOTE: You also have the option to use the migration table exclusively and to migrate the security filter.
•
Click Finish.
Once you have reviewed the settings and the effects on the target domain, check in the object and request Approval. For more information, see Requesting approval .
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating