---
title: "Back Up and Restore Every Group Policy Object in PowerShell"
description: "Back up every Group Policy Object with Backup-GPO, restore one or all with Restore-GPO, and recover a deleted GPO with Import-GPO and New-GPLink."
canonical: "https://adamtheautomator.com/backup-restore-gpos-powershell/"
---

# Back Up and Restore Every Group Policy Object in PowerShell

> Back up every Group Policy Object with Backup-GPO, restore one or all with Restore-GPO, and recover a deleted GPO with Import-GPO and New-GPLink.

Source: https://adamtheautomator.com/backup-restore-gpos-powershell/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Back Up and Restore Every Group Policy Object in PowerShell](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b814eba23fbf8d18b64a2/ade916ad78256face2456a10aacfbb82051f4957bf03d6f163193b25395e5183.jpg)

# Back Up and Restore Every Group Policy Object in PowerShell

[![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)21 October 20263 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[PowerShell](/tag/powershell/)[Group Policy](/tag/group-policy/)[Backups](/tag/backups/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [Back Up Every GPO with Backup-GPO](#back-up-every-gpo-with-backup-gpo)
*   [Put Each Backup in a Dated Folder](#put-each-backup-in-a-dated-folder)
*   [Restore GPOs](#restore-gpos)
*   [Restore One GPO by Name](#restore-one-gpo-by-name)
*   [Restore Every GPO from One Dated Folder](#restore-every-gpo-from-one-dated-folder)
*   [Roll Back to an Older Backup by ID](#roll-back-to-an-older-backup-by-id)
*   [Recover a Deleted GPO](#recover-a-deleted-gpo)
*   [Relink the Recovered GPO](#relink-the-recovered-gpo)
*   [Schedule It and Test It](#schedule-it-and-test-it)

Don’t edit a production Group Policy Object (GPO) until you hold a copy you can restore. Every computer that processes the Default Domain Policy inherits any bad setting in it. After a stray delete, you’d spend an afternoon rebuilding that policy from memory.

Don’t trust a backup folder you’ve never restored from, and never let two backup runs share one.

## Prerequisites

To follow along, have:

*   A domain controller, or a workstation with the Group Policy Management tools, because the cmdlets live in the [GroupPolicy module](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/?view=windowsserver2025-ps).
    
*   A domain admin account, the simplest way to avoid permission errors.
    
*   A backup folder you create yourself. The [Backup-GPO reference](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/backup-gpo?view=windowsserver2025-ps) states: “The backup directory and GPO must already exist.”
    

## Back Up Every GPO with Backup-GPO

Start with the whole domain. Create the folder first:

```powershell
New-Item -Path C:\GPOBackups -ItemType Directory
```

Then run `Backup-GPO` with [`-All`](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/backup-gpo?view=windowsserver2025-ps#-all):

```powershell
Backup-GPO -All -Path C:\GPOBackups
```

`-All` backs up every GPO in the domain of the account running the session into the folder `-Path` names. The cmdlet returns one object per GPO.

Its `Id` property is the backup ID, which differs from `GpoId`, the GPO’s own identifier. Restoring by `-BackupId` later needs `Id`, not `GpoId`.

## Put Each Backup in a Dated Folder

Run `Backup-GPO -All` twice into one folder and that folder holds two backups of every GPO.

The [Restore-GPO reference](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/restore-gpo?view=windowsserver2025-ps#-all) says of `-All`: “Each GPO is restored from its most recent backup in the directory.”

So to return the whole domain to last Tuesday, you need last Tuesday’s run in its own folder.

This one-liner creates a folder named for the current date and time and backs up into it:

```powershell
$path = "C:\GPOBackups\$(Get-Date -Format 'yyyy-MM-dd_HHmm')"; New-Item -Path $path -ItemType Directory | Out-Null; Backup-GPO -All -Path $path -Comment "Nightly backup"
```

The `yyyy-MM-dd_HHmm` format sorts in date order. `Out-Null` hides the folder object `New-Item` prints. Each backup also keeps the note passed to `-Comment`. The image below shows every run in its own folder.

![Dated GPO backup folders](https://adamtheautomator.com/wp-content/uploads/publisher/841b7ad69a23dfb553bb7d235342d1c1a296173c63df7d2c86bc7ef88d58abf4.jpg)

* * *

_**Pro Tip: Point ******`-Path`****** at a share on a different server, like ******`\\backupsrv\GPOBackups`******. Otherwise the backups go down with the domain controller you’re recovering.**_

* * *

## Restore GPOs

`Restore-GPO` overwrites a live GPO with the contents of a backup in the original domain. Every form takes the `-Path` of a backup folder plus one selector: `-Name`, `-Guid`, `-All`, or `-BackupId`.

Add [`-WhatIf`](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/restore-gpo?view=windowsserver2025-ps#-whatif) to preview the change first.

### Restore One GPO by Name

Point `-Name` at the display name and `-Path` at the dated folder:

```powershell
Restore-GPO -Name "Workstation Baseline" -Path C:\GPOBackups\2026-10-14_0200
```

The cmdlet restores the most recent backup of that GPO in that folder. Two GPOs sharing a display name make the cmdlet error out, so switch to `-Guid` for those.

### Restore Every GPO from One Dated Folder

Replace `-Name` with `-All` to return the domain to the moment of that run:

```powershell
Restore-GPO -All -Path C:\GPOBackups\2026-10-14_0200
```

* * *

_**Warning: ******`-All`****** overwrites every GPO that has a backup in the folder, including ones someone edited legitimately since that run. Confirm the folder date and run it with ******`-WhatIf`****** first.**_

* * *

### Roll Back to an Older Backup by ID

Running that first `Backup-GPO -All` into `C:\GPOBackups` more than once leaves several backups of each GPO in one folder. Name the exact one with `-BackupId`, the `Id` that `Backup-GPO` returned:

```powershell
Restore-GPO -BackupId 0fc29b3c-fb83-4076-babb-6194c1b4fc26 -Path C:\GPOBackups
```

The backup identifies its own GPO, so `-Name` is unnecessary.

## Recover a Deleted GPO

But `Restore-GPO` stops working once a GPO is deleted. Its reference states: “If the original domain is not available, or if the GPO no longer exists in the domain, the cmdlet fails.”

[Import-GPO](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/import-gpo?view=windowsserver2025-ps) writes into a target GPO that “does not have to exist prior to the operation,” according to its reference:

```powershell
Import-GPO -BackupGpoName "Workstation Baseline" -TargetName "Workstation Baseline" -Path C:\GPOBackups\2026-10-14_0200 -CreateIfNeeded
```

*   `-BackupGpoName` selects the most recent backup of that GPO in the folder.
    
*   `-TargetName` names the GPO to fill.
    
*   `-CreateIfNeeded` creates that GPO when it’s missing; otherwise the command fails.
    

The result is a new GPO, with a new GUID, carrying the old settings. Microsoft’s [Group Policy backup and restore guide](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-backup-restore) warns: “Importing a GPO transfers only the GPO settings.”

So the new GPO starts with default permissions, not the original security filtering. Reapply the original filtering and delegation before you run `New-GPLink`.

To keep the original GUID and permissions, restore the deleted GPO from GPMC’s **Manage Backups** dialog instead. The decision flow below shows the PowerShell path.

![GPO restore decision flow](https://adamtheautomator.com/wp-content/uploads/publisher/4540bfb2524e8d7bcc19a9b1994fda06fc3862772dcd42a3ce3fb179b49a2937.jpg)

## Relink the Recovered GPO

`Backup-GPO` saves a GPO’s contents, but its links to sites, domains, and organizational units (OUs) stay behind.

Microsoft’s [Scripting Guy post on backing up GPOs](https://devblogs.microsoft.com/scripting/using-powershell-to-back-up-group-policy-objects/) calls these scope-of-management details that the Group Policy cmdlets don’t capture.

So the recovered GPO arrives unlinked and applies to nothing until you link it, like any [unlinked GPO](https://adamtheautomator.com/unlinked-gpo/).

Recreate the link with [New-GPLink](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/new-gplink?view=windowsserver2025-ps):

```powershell
New-GPLink -Name "Workstation Baseline" -Target "ou=Workstations,dc=contoso,dc=com"
```

`-Target` takes the LDAP distinguished name of the link target. Add `-Order` and `-Enforced Yes` when the original link had a set precedence or was enforced. [Write down each GPO’s targets](https://adamtheautomator.com/powershell-export-gpo/) in your runbook now.

## Schedule It and Test It

Microsoft’s backup and restore guide says: “Part of your ongoing Group Policy operations plan should include regular backups of all GPOs.”

Save the dated-folder one-liner as a script and register it with [Register-ScheduledTask](https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/register-scheduledtask?view=windowsserver2025-ps). Its `-User` account must read every GPO and write to the backup share.

Check the newest dated folder after the first run.

* * *

_**Reality Check: You don’t know a restore works until you’ve run one. Rehearse every command above on a test GPO in a lab domain first.**_

* * *

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fbackup-restore-gpos-powershell%2F&text=Back%20Up%20and%20Restore%20Every%20Group%20Policy%20Object%20in%20PowerShell)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fbackup-restore-gpos-powershell%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fbackup-restore-gpos-powershell%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2020/09/Group-Policy-Report.png)

### [Export GPOs with PowerShell: Creating Fancy GPO Reports](/powershell-export-gpo/)

Learn to import GPO modules in PowerShell, export GPOs, and generate GPOs linked to an OU for detailed reporting.

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b817aab5dca59f1ca0e14/38378bffb6e067df12a1bd90a3921833213a6e328f7d3baabd1fae698d38ddfd.jpg)

### [Fix Kerberos Clock Skew Logon Failures Using w32tm](/fix-kerberos-clock-skew-w32tm/)

Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients.

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81798ecbd4ce17ad4211/3af27311d4ef00790ee9d17c229fa6097b6ee8b242b0a21e0b024c9807f61639.jpg)

### [Who Really Restarted Windows Server? Event ID 1074 and 6008](/event-id-1074-windows-server-restart/)

Use one Get-WinEvent filter to find which account, process, and reason restarted a Windows Server, from Event ID 1074 and 6008 logs.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)