Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Group Policies / How to Backup and Copy Local Group Policy Settings to Another Computer

March 17, 2024 Group PoliciesWindows 10Windows 11

How to Backup and Copy Local Group Policy Settings to Another Computer

Group Policies are used to centrally configure settings for computers and users in Windows. If your computers are joined to a Windows domain, you can use domain GPOs to bring all the computers within an Active Directory domain into a single configuration. If you do not have a domain, you can use the local Group Policy to configure the settings for a single computer (the local Group Policy Editor is started with the gpedit.msc command). In this article, we’ll show you how to back up a local GPO and copy the local policy settings to other computers.

If your network is based on a Windows workgroup, you can use local Group Policy to get all of your computers to have the same configuration. To do this, you need to configure local GPO options on the reference computer, and then copy and apply these settings to other computers.

Contents:
  • How to Manually Copy Local GPO Settings to Another Computer
  • How to Backup (Export) Local Group Policy with LGPO.exe
  • Import (Restore) Local Group Policy Settings on Windows
  • Export and Import Group Policy Settings with LocalGPO

How to Manually Copy Local GPO Settings to Another Computer

There are no built-in tools in Windows to back up, import, export, or migrate local GPO settings.  Windows stores local Group Policy administrative template settings in Registry.pol files under the following paths:

  • %SystemRoot%\System32\GroupPolicy\Machine\
  • %SystemRoot%\System32\GroupPolicy\User\

Therefore, the easiest way to transfer local Group Policy settings between computers is to manually copy and replace the contents of the %systemroot%\System32\GroupPolicy folder from one computer to another. You must manually update the Group Policy settings with the gpupdate /force command or restart Windows after replacing the GPO files.

Main drawbacks of this GPO migration method:

  1. Settings from local Security Templates are not copied;
  2. Errors may occur when applying the GPO if the version of Windows on the target computer is different;
  3. You cannot import local GPO settings into the domain Group Policy Management Console (gpmc.msc);
  4. There are some issues with the migration of settings from custom ADMX templates.

How to Backup (Export) Local Group Policy with LGPO.exe

Microsoft recommends the use of the LGPO.exe console tool for the backup/import/export and transfer of local Group Policy settings. LGPO (current version 3.0) is included in the Microsoft Security Compliance Toolkit and is available to download here https://www.microsoft.com/en-us/download/details.aspx?id=55319.

download lgpo.exe tool

LGPO supports all modern versions of operating systems, including Windows 10/11 and Windows Server 2022/2019/2016.

The LGPO.exe utility allows you to:

  • Export local group policy settings to files;
  • Import GPO settings from the backup. Allows to import registry.pol files, security templates, and CSV files;
  • Convert registry.pol files to readable LGPO format and vice versa.

To backup (export) the current local GPO settings to the specified directory, use the command:

LGPO.exe /b c:\tools\GPO

create local gpo backup

The tool saves the local policy settings in a folder with a random GUID name.  This directory contains all of the necessary files that are required to restore the local GPO settings or to apply them to a different computer.

You can also import a directory of local GPO settings into the domain Group Policy Management console. Or use the PowerShell GPO management module> to upload a configured policy to a domain:

Restore-GPO -Name Win10Settings -Path C:\Backup\GPO_W10\

To conveniently view the current GPO settings in the registry.pol file, run the following command:

lgpo.exe /parse /m "C:\Tools\GPO\{985966AD-21BE-4A9C-BF7D-26C879982067}\DomainSysvol\GPO\Machine\registry.pol" >>c:\tools\gpo\lgpo.txt

The target lgpo.txt text file contains the registry settings that are applied by this policy.

lgpo: view registry.pol file settings

You can manually edit the lgpo.txt file and convert it to the registry.pol format:

LGPO.exe /r "C:\tools\GPO\lgpo.txt" /w "C:\tools\GPO\registry_new.pol​"

To apply the new settings from the registry_new.pol file to the computer’s current local policy:

LGPO.exe /m "C:\tools\GPO\registry_new.pol​"

Import (Restore) Local Group Policy Settings on Windows

To import (restore) local GPO settings from a backup on another computer, you must copy the Policy GUID directory to the target computer and run the command:

LGPO.exe /g C:\tools\GPO\

lgpo import settings

Some administrators use Multiple Local Group Policies (MLGPO) to apply individual local  GPO settings only to specific groups (non-administrators or administrators) or users. By default, the lgpo.exe doesn’t export the MLGPO settings.

The next thing we’ll look at is how to copy the MLGPO settings for specific users or groups to other computers.

When an administrator creates a new Local MLGPO Policy for a specific local user or group (mmc -> Add/Remove Snap-in -> Group Policy Object Editor -> select a local group or a user to apply a policy to: Users, Administrators, Non-Administrators, specific user, etc.), a separate folder is created for that GPO in the C:\Windows\System32\GroupPolicyUsers directory. The SID of the user or group is used as the directory name. For example:

  • S-1-5-32-545 – non-administrators (BUILTIN\USERS)
  • S-1-5-32-544 –administrators (BUILTIN\ADMINISTRATORS)

multiple local gpo folders in GroupPolicyUsers

For example, you might want to copy the settings of the local GPO for non-administrators to another computer.

  • From the reference computer, copy the Local Policy Settings file from the directory with the required SID ( C:\Windows\System32\GroupPolicyUsers\S-1-5-32-545\User\Registry.pol );
  • To apply the Registry.pol file for non-administrators on the target computer, run the following command:lgpo /un "C:\tmp\Registry.pol"
Import MLGPO settings for Non-Administrators from registry.pol

import mlgpo user settings for non-administrators

To import GPO settings from the registry.pol file and apply them to the Administrators group, use the command:

lgpo /ua "C:\tmp\Registry.pol"
Import GPO settings from a file and apply the policy to a specific local user:

lgpo /u:username "C:\tmp\Registry.pol"

Export and Import Group Policy Settings with LocalGPO

Previously, the LocalGPO script (part of Microsoft Security Compliance Manager 3.0) was used to import and export the local Group Policy configuration. The LocalGPO tool allows you to quickly create a backup copy of a local GPO and restore local policy settings from it. It also has an interesting option to create a GPOPack executable file that allows you to migrate (import) local GPO settings to another machine with a single click.

Important. The LocalGPO tool is now deprecated and no longer officially supported on modern Windows 10/11 and Windows Server 2016/2019/2022.

To export local Group Policy settings to the C:\GPObackup directory (the target folder must be created in advance):
cscript LocalGPO.wsf /Path:C:\GPObackup /Export

The LocalGPO utility allows you to export MLGPO settings for a specific group or user to a separate directory. Syntax used:

cscript LocalGPO.wsf /Path:C:\GPObackup /Export /MLGPO:Administrators
or
cscript LocalGPO.wsf /Path:C:\GPObackup /Export /MLGPO:LocalUserName

To restore local Group Policy settings from a previous backup copy:

cscript LocalGPO.wsf /Path:C:\GPObackup\{B6542366-C0C0-4948-AF39-B17F0B1F0E9A}

LocalGPO allows you to reset all current local Group Policy settings to the default:

cscript LocalGPO.wsf /Restore

Tip. In the previous article, we showed how to manually reset your local Group Policy settings.
24 comments
9
Facebook Twitter Google + Pinterest
previous post
How to Reset a Local Administrator Password on Windows
next post
Getting Started with Windows Recovery Environment (WinRE)

Related Reading

Configure NTP Time Source for Active Directory Domain

May 6, 2025

How to Cancel Windows Update Pending Restart Loop

May 6, 2025

View Windows Update History with PowerShell (CMD)

April 30, 2025

Change BIOS from Legacy to UEFI without Reinstalling...

April 21, 2025

Remove ‘Your License isn’t Genuine’ Banner in MS...

April 21, 2025

24 comments

TonyR October 23, 2015 - 5:51 pm

This is great for 2008/2008R2, but it does not work in 2012/2012R2. Even after you edit the wsf script to stop it from checking for OS (which, if you leave that in, it will TELL you that it cannot run in 2012), but even after commenting that check out, it will run, but it will not actually import the policy settings.

Reply
detroy July 16, 2016 - 12:32 pm

This tool does not run on windows 10 Pro 64 bit. What is other alternative?

Reply
Vincent Duvernet July 12, 2018 - 8:26 am

Same problem. I’m trying this tool :
https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/

Reply
up January 27, 2017 - 3:50 pm

try LGPO.exe from MS

Reply
kyetoy October 10, 2017 - 9:38 pm

Dont Work for Windows 8.1. This tool is only for Windows 8 and before.

Reply
admin October 11, 2017 - 5:42 am

You can use LGPO.exe, which replaces LocalGPO. It is part of the Security Compliance Manager package

Reply
Creating a scheduled task and a local policy for BitLocker to back up the recovery key to Active Directory – System Center Configuration Manager Notes June 13, 2018 - 4:30 pm

[…] here https://technet.microsoft.com/en-us/library/cc936627.aspx to backup the settings (thanks to https://woshub.com/backupimport-local-group-policy-settings/ for pointing me in this direction).  I also created the scheduled task that runs the following on […]

Reply
Vincent Duvernet July 12, 2018 - 9:07 am

Edit LocalGPO.wsf to replace the ChkOSVersion routine (it will support 8.1, 10, 2k16) :

'****************************
'
' Routine Name:
'
' ChkOSVersion
'
' Description :
'
' This routine gets the Operating System's caption,version and Service
' Pack information on the host
'
' Inputs:
'
' None.
'
' Outputs:
'
' None.
'********************************
Sub ChkOSVersion

Dim colOperatingSystems, objOperatingSystem
Dim colComputers, objComputer, strProductType

Set colOperatingSystems = objWMIService.ExecQuery _
("Select * from Win32_OperatingSystem")

For Each objOperatingSystem in colOperatingSystems
strOpSys=objOperatingSystem.Caption
strOpVer=objOperatingSystem.Version
strSPMinorVer=objOperatingSystem.ServicePackMinorVersion
strSPMajorVer=objOperatingSystem.ServicePackMajorVersion
strProductType=objOperatingSystem.ProductType
Next

strComputerRole = NULL

Set colComputers = objWMIService.ExecQuery _
("Select DomainRole from Win32_ComputerSystem")
For Each objComputer in colComputers
Select Case objComputer.DomainRole
Case 0
strComputerRole = "Standalone"
Case 1
strComputerRole = "Member"
Case 2
strComputerRole = "Standalone"
Case 3
strComputerRole = "Member"
End Select
Next

'Checks whether the operating system is Windows XP or _
'Windows Server 2003 or Windows Vista or Windows Server 2008 or _
'Windows 7 or Windows Server 2008 R2 or Windows 8 or Windows Server 8

If(Left(strOpVer,4) = "10.0") and (strProductType = "1") then
strOS = "Win10"
ElseIf(Left(strOpVer,3) = "6.3") and (strProductType <> "1") then
strOS = "WS16"
ElseIf(Left(strOpVer,3) = "6.3") and (strProductType = "1") then
strOS = "Win81"
ElseIf(Left(strOpVer,3) = "6.2") and (strProductType <> "1") then
strOS = "WS12"
ElseIf(Left(strOpVer,3) = "6.2") and (strProductType = "1") then
strOS = "Win8"
ElseIf(Left(strOpVer,3) = "6.1") and (strProductType <> "1") then
strOS = "WS08R2"
ElseIf(Left(strOpVer,3) = "6.1") and (strProductType = "1") then
strOS = "Win7"
ElseIf(Left(strOpVer,3) = "6.0") and (strProductType <> "1") then
strOS = "WS08"
ElseIf(Left(strOpVer,3) = "6.0") and (strProductType = "1") then
strOS = "VISTA"
ElseIf(Left(strOpVer,3) = "5.2") and (strProductType <> "1") then
strOS = "WS03"
ElseIf(Left(strOpVer,3) = "5.2") and (strProductType = "1") then
strOS = "XP"
ElseIf(Left(strOpVer,3) = "5.1") and (strProductType = "1") then
strOS = "XP"
Else
strMessage = DisplayMessage(conLABEL_CODE002)
Call MsgBox(strMessage, vbOKOnly + vbCritical, strTitle)
Call CleanupandExit
End If
End Sub

Reply
Vincent Duvernet July 12, 2018 - 9:09 am

🙁 the code is not well copied in the comment :
strProductType “1”
should be
strProductType “1”
(remove the space between )

Reply
admin July 13, 2018 - 6:15 am

Hi, thanks for info! I updated your code (this is an old WordPress problem with quotes).

Reply
Shantaram Gawade February 14, 2019 - 6:58 am

LocalGPO is not working for Windows Server 2016 after editing LocalGPO.wsf with above mentioned code, request you to please provide updated LocalGPO.wsf

Reply
Shantaram Gawade February 18, 2019 - 9:15 am

Dear Admin,

Awaiting for your response….
Thanks in Advance!!

Reply
admin March 5, 2019 - 12:28 pm

In Windows 10 and Windows Server 2016 instead of LocalGPO.wsf it is recommended to use lgpo.exe
LocalGPO.wsf is deprecated tool.

Reply
acg June 10, 2019 - 4:11 pm

Great. Thanks
A question: I have manually modified a GPO policy called “prevent the installation of removable devices”. How do I backup/apply/restore this specific policy GPO with LGPO utility v1.0 (LPGO.exe) and apply the changes without restarting the PC?

Reply
admin July 8, 2019 - 5:25 am

You cannot save or restore a separate setting (policy) of a local GPO, only all GPO settings at the same time.

Reply
Acg July 8, 2019 - 12:25 pm

Ok. But how i can reset all gpo?

Reply
Shantaram Gawade July 8, 2019 - 6:49 am

Dear Admin,
Request you to please let me know how should I identify Windows OS version from LocalGPO Backup file.
I am not able to identify the backup file of Windows version while restoring the backup file.

Also Can I restore Windows7 Group Policy Setting file to Windows10 system??
Is there any OS compatibility issues?
Awaiting for your valuable response.

Thanks in Advance.

Reply
acg July 8, 2019 - 1:34 pm

Look at this. Any solution? https://superuser.com/questions/1447033/how-to-reset-gpo-rule

Reply
Ozi January 7, 2020 - 7:53 pm

Спасибо большое за полезную статью – то что искал!..

Reply
Gisabun January 14, 2020 - 1:59 pm

Gents [and ladies?]. Why are you looking at LocalGPO? It is outdated. And if something screws up, MS won’t even hep you. Use LGPO.

Reply
Chris November 30, 2020 - 7:40 pm

Hey Admin, many thanks for your advices running LocalGPO on Windows10! I’m searching for a way to export local user related GPOs, but /Export /MLGPO:Username won’t work and lgpo.exe doesn’t have this function 🙁

Reply
Chris November 30, 2020 - 7:42 pm

I mean for a specific user, not the local GPOs for all users

Reply
Dorneanu Narcis March 24, 2021 - 1:36 pm

The LGPO tool works even in server 2019 with no issues. I have used it in several environments to deploy policies for other servers after configuring local policy objects for computer, admins, and non-admins

Reply
Pat January 4, 2023 - 11:50 am

How would you use lgpo.exe to backup non-admin policies as well? It’s only backing up “Local Computer Policy” not “Local Computer\Non-Administrators Policy”.

Reply

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMware
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025
  • How to Write Logs to the Windows Event Viewer from PowerShell/CMD

    March 3, 2025
  • How to Hide (Block) a Specific Windows Update

    February 25, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Updating List of Trusted Root Certificates in Windows
  • Fix: Remote Desktop Licensing Mode is not Configured
  • Configure Google Chrome Settings with Group Policy
  • How to Delete Old User Profiles in Windows
  • Allow Non-admin Users RDP Access to Windows Server
  • Configuring FSLogix Profile Containers on Windows Server RDS
  • How to Find the Source of Account Lockouts in Active Directory
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top