Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.
  
  
  Advanced Search 


Return to article

How can I restore the contents of the Default Domain and Default Domain Controller (DC) Group Policy Objects (GPOs)?
 

A. Best practice stipulates that you shouldn't modify the Default Domain and Default DC GPOs. Instead, you should create new GPOs and link them to the relevant containers. However, if you've already modified the GPO and want to restore the default content, perform the following steps:

  1. Log on as a domain administrator to a DC.
  2. Start a command session.
  3. To reset the Domain GPO, type
    dcgpofix /target:Domain
    To reset the Default DC GPO, type
    dcgpofix /target:DC
    To reset both the Domain and Default DC GPOs, type
    dcgpofix /target:both
  4. After you enter the appropriate command in Step 3, enter Y to both prompts.
  5. Close the command window.

For example, when I type

dcgpofix /target:both

my computer returns the following output:

  Microsoft(R) Windows(R) Operating System Default Group Policy Restore
  Utility v5.1

  Copyright (C) Microsoft Corporation. 1981-2003

  Description: Recreates the Default Group Policy Objects (GPOs) for a
  domain

  Syntax: DcGPOFix [/ignoreschema] [/Target: Domain | DC | BOTH]

  This utility can restore either or both the Default Domain policy or
  the Default Domain Controller policy to the state that exists
  immediately after a clean install. You must be a domain administrator
  to perform this operation.

  WARNING: YOU WILL LOSE ANY CHANGES YOU HAVE MADE TO THESE GPOs. THIS
  UTILITY IS INTENDED ONLY FOR DISASTER RECOVERY PURPOSES.

  You are about to restore Default Domain policy and Default Domain
  Controller policy for the following domain
  
  savilltech.com
  
  Do you want to continue: ? Y

  WARNING: This operation will replace all 'User Rights Assignments'
  made in the chosen GPOs. This may render some server applications to
  fail. 

  Do you want to continue: ? Y

  The Default Domain Policy was restored successfully.

  Note: Only the contents of the Default Domain policy was restored.
  Group Policy links to this Group Policy Object were not altered.
  By default, the Default Domain policy is linked to the Domain.

  The Default Domain Controller policy was restored successfully.

  Note: Only the contents of the Default Domain Controller policy was
  restored. Group Policy links to this Group Policy Object were not
  altered.

  By default, the Default Domain Controller policy is linked to the
  Domain Controllers OU.






Reader Comments

Good day! It is very imformative. How about for windows 2000 default controller policy? Is there a way to restore the content? More power.

Erwin Mendoza -March 16, 2004

How can I restore the contents of the Default Domain and Default Domain Controller (DC) Group Policy Objects (GPOs)? in windows 2000 server

Kostya -March 17, 2004

http://support.microsoft.com/?kbid=226243 See this KB Article for 2000

lazyadm1n -January 19, 2005

It is very imformative.

Anonymous User -August 24, 2005
Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro DevProConnections IT Job Hound
Left-Brain.com Technology Resource Directory asp.netPRO ITTV Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 © 2009 Penton Media, Inc. Terms of Use | Privacy Statement