Chat now with support
Chat with Support

Welcome, Quadrotech customers to Quest Support Portal click here for for frequently asked questions regarding servicing your supported assets.

GPOADmin 5.13.5 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root) Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Working with the GPOADmin Dashboard Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands About Us

Synchronizing GPOs

Synchronizing GPOs allows you to automatically push out pre-defined “master GPO” settings to specified targets both within a forest and between two forests. This allows you to ensure specific GPOs, which are required in every domain, contain the same settings without having to link to a GPO outside of the domain.

You will be able to select one or more GPOs from various domains as synchronization targets for the source GPO. When the source GPO has been successfully deployed, the settings from the last major backup will be imported into each synchronization target GPO.

* 
NOTE: If permissions between forests are not identical, a mapping table is also available to ensure that forest specific settings are covered.
•
Enabling synchronization
•
Working with GPO synchronizations
•
Generating Synchronized GPO report

Enabling synchronization

The ability to synchronize GPOs require that:

•
It is enabled within the source domain.
•
The source GPO must be workflow-enabled to ensure that any changes can be propagated to the targets. (The targets, however, can be workflow-disabled.)
•
Targets are registered.
•
The source GPO has been deployed at least once.
•
Target synchronization settings are configured.
•
Each domain has a GPOADmin server. Child domains of a parent domain will appear in the client by default. Trusted siblings however will not.
•
The user performing a manual synchronization or setting the synchronization targets has the Synchronize right.
To enable GPO synchronization
1
Right-click the forest and select Options.
2
Select Options| General.
3
Select Enable Group Policy Object Synchronization.
4
Click OK.
Once this has been enabled, you can access the synchronization options by right-clicking a GPO in the Version Control Root and selecting Synchronize.

Working with GPO synchronizations

Keep the following in mind when working with synchronizations:

•
The target settings will be overwritten with the settings from the source.
•
If a synchronization is attempted while a target GPO is checked out, the synchronization will fail.
•
If a target is off line, the synchronization will fail.
•
If the source GPO is out of compliance and either a ‘Rollback’ or ‘Incorporate Live’ compliance action will trigger a synchronization.
•
Communicate synchronizations plans to those responsible for GPO administration in other domains.
•
If GPO synchronization is enabled on a targeted GPOADmin server, ensure that the target GPO does not have the source GPO set as a synchronization target. Doing so will place the two GPOs in an endless synchronization loop.
•
When changing the service account, any existing GPO synchronization configuration should be reconfigured to ensure the proper password is used to connect to the target GPOADmin server.
To set up synchronization
1
In the Version Control Root, right-click the source GPO, and select Synchronize | Set Synchronization Targets.
This will open a dialog where you can add GPO targets and configure their synchronization settings. By default, the server that you are currently connected to will be displayed. It cannot be removed.
2
If required, select Add Servers to include other servers that contain the GPOs that you want to target. Select the server and click Connect. Enter the required credentials and click OK.
* 
NOTE: The credential entered will be stored and used to connect to the associated server during the synchronization process.This allows for the synchronization of GPOs between untrusted domains.
You can also select to remove any servers that have been added. If you do however, any target GPOs setup from this server for synchronization will also be removed.
3
Right-click in the dialog and select Add Synchronization Target to select the required target GPOs. The list of all available GPOs will display.
4
Select the required targets and click OK.
5
If required, we provide the option to setup a migration table by right-clicking the target and choosing Select Migration Table. From here, you can add (or remove), create, modify the migration tables that are going to be used during the synchronization using the Microsoft Migration Table Editor.
The migration tables, which are xml files, contain the mapping between the source and the target accounts to ensure they have the same access. If permissions are not an issue, the migration table would not be required. It is stored in C:\Program Files\Quest\GPOADmin\MigrationTables.
You are now ready to set the synchronization options.
6
Right-click the target to set the synchronization options. You can choose between the following:
•
Clear Migration table: Clear the tables when no longer required.
•
Use Migration Table Exclusively: If enabled, the migration (import operation) will not proceed if any settings security principals or UNC paths configured within the source GPO do not exist in the migration table.
•
Migrate Security Filters: Migrates any security principals from the security filter that are found in the migration table.
•
Target State: Select the state that you want the target to be in after the synchronization completes. You can choose between Available, Checked Out, Pending Approval, or Deployed. The default is Checked Out.
* 
NOTE: If a target state of Deployed is to be used, it is recommended that this account is a member of the GPOADmin Administrators as they are the only ones who can Approve multiple times.
•
Synchronize Deletions: Select to enable this option, if you want any deleted source GPOs to also be deleted in the target.
•
Set target WMI Filters: Select this option to synchronize WMI filters between domains. You can choose between the following options:
•
None: When you select this option, the WMI filter in the target GPO will not be updated. Use this option to disable previously set WMI Filter synchronizations.
•
Auto-map By Name: When you select this option, if a WMI Filter in the target domain is found with the same name as the WMI Filter linked to the source GPO, it is assigned to the target GPO.
•
Select WMI Filter: This opens a browser that lists all of the WMI Filters in the target domain where the connected account has access. From this list, select the WMI Filter to assign to the target GPO.
7
Once you have your targets set, it is recommended to validate the synchronization targets by selecting the target GPO and clicking Validate Synchronization Targets.
The synchronization targets are stored using their version control id and their display name. Over the course of time, the name may change or the object may be deleted. During the validation a connection to the target server is made and a check is performed to see if the synchronization target still exists or if the name has changed.
If there is an issue, the target will be displayed with warning icon and a tool-tip to inform you of the issue.
1
If you select to Cancel the editor, the warning will not persist.
2
If you select OK, the warning will remain to alert you that the issues must be addressed. When ready to address the issue, simply select the Correct button at the top of the dialog or right-click and select Correct.
To change the service account used to synchronize GPOs
1
In the Version Control Root, right-click the source GPO, and select Synchronize | Set Synchronization Targets.
This opens a dialog that displays the GPO targets and their synchronization settings.
2
Right-click any one of the target GPOs, select Update Credentials, and enter the new credentials.
To perform a manual synchronization
•
In the Version Control Root, right-click the source GPO and select Synchronize | Synchronization Now.
This allows you to perform a synchronization without redeploying the source GPO.

Generating Synchronized GPO report

You can create a report that contains information on the GPO synchronizations that have been performed in your environment.

For details see the section Creating Diagnostic and Troubleshooting Reports .

Related Documents