Active Directory – How to Export All Group Policies to an Easily-Parseable Format

active-directoryexportgroup-policytext;

I need to dump all the Group Policies within Active Directory to review offline at a later date. Is there a way I can easily export all the Group Policies to text or some other easily-parseable format?

Edit:
Will these tools work from a computer that is not part of the domain? I have domain credentials, but my work laptop isn't necessarily part of the domain I need to review.

Best Answer

Unfortunately, with the modular nature of group policy extension handlers I don't believe you're going to find any tool better than Group Policy Management Console to do what you're after.

Your easiest path is going to be to either use a computer joined to the domain to run GPMC and examine / export the GPOs. Of course, if there are GPOs that have had their default permissions modified you might not have access to them w/ your credentials to audit them.

Given how easy it would be do to what you want with GPMC on a domain-member computer I'd say that you should pursue that. If you have problems, I'd approach it as a "political" / management problem and not a technical problem. GPMC is the right tool for the job, and if you're expected to do the job you need to have access to do it. The same would go with accessing GPOs that your domain credentials might not have access to.

If you absolutely can't get access to a domain-member computer running GPMC your next best (but undesirable alternative) would be to have an administrator there backup all the GPOs and give the backup to you. You could import that backup into another AD domain that you do control and audit the GPOs there. The problem with that strategy is that all SID information in the original domain will be incomprehensible to you in your own domain (and will be lost if you "map" the imported GPOs to users / groups inside your domain).

GPMC is your tool. Figure out how to make the "powers that be" allow you to use the tool and you'll get the job done quickly and efficiently.

Related Solutions

Domain – Software restriction policies set in the registry don’t update Local Group Policy

Local Group Policies get stored outside of the registry in C:\Windows\System32\GroupPolicy and get merged into the registry during startup (for computer policies) or logon (for user policies). You need to view them as a separate entity which need not actually even exist for a setting to take effect.

When you view the local policy in gpedit.msc what you're viewing is what is in the C:\Windows\System32\GroupPolicy folder, not what's currently in the registry.

One suggestion would be to modify the local policy to taste on a test machine and drop the relevant files onto your other machines, but I haven't tested this and can't confirm it would work. Overall though I honestly think you're better off biting the bullet and putting Windows Domain Controllers in. You may be saving money on license fees with your current approach, but you're just losing a whole lot of time on maintaining an elaborate (and potentially delicate) setup that using Windows DCs would totally bypass. Unfortunately I suspect that the cost of the time you're losing would be multiples of the cost of just implementing Windows DCs.

How to export all e-mail addresses from Exchange 2003

If you only need primary email addresses, you can run this on your Exchange server, filling in the domain and com values:

csvde -r "(mail=*)" -d "dc=domain,dc=com" -l mail -f c:\gal.csv

To get secondary email addresses, its a bit trickier. You can use this to generate a file:

ldifde -f dump.ldf -l proxyaddresses

Found a method to extract the email addresses from the LDF file here: http://bytes.com/topic/unix/answers/648158-extract-email-addresses-big-file

If you have access to perl within Windows, make a perl file that contains this:

while (<STDIN>) { 
while (/[\w\.\-]+@[\w\.\-]+\w+/g) 
    {print "$&\n"}}

Then run this command:

perl ExtractEmail.pl <dump.ldf >out.txt

Out.txt should contain all your email addresses.

Best Answer

Related Solutions

Domain – Software restriction policies set in the registry don’t update Local Group Policy

How to export all e-mail addresses from Exchange 2003

Related Topic