Backups are critical inside any environment. To most users, this means storing extra copies of their documents in case they are lost, but those of us who work in IT know that backups mean so, so much more. It's not just about keeping multiple offsite copies of data in case that data is lost or damaged; backups are also a key piece to any disaster-recovery scenario. When a server goes down, you need a plan (and a backup) to deal with restoring that server. When a system gets hacked, you need a plan and a backup in order to wipe and restore that machine. It would be great if we had one big Backup Now button for a domain and everything inside of it, but the reality is that each piece of technology we use inside our networks has special considerations when it comes to backups.

This is especially true when it comes to Domain Controllers and the data that resides on them. Not only do physical Domain Controller servers have special backup requirements, but more and more companies are running virtual Domain Controllers and those have some interesting gotchas when trying to keep copies of those virtual machines. As you know, Group Policy data is stored on your Domain Controller servers. Since most companies run multiple Domain Controllers, and Group Policy data is automatically replicated among all DCs, simply having multiple servers in the mix offers some redundancy for Group Policy built right into the solution. If you are keeping good backups of those Domain Controllers, even better – you now have built-in redundancy as well as copies of the actual data that could be restored in a pinch.

Backups and restores in Group Policy are, therefore, more like rollback capabilities than they are actual data-recovery capabilities. At least, this is true in practice. You create backups of GPOs in order to create rollback points in case the change you are about to make goes sideways. Or, perhaps you make it standard practice to create a new backup of any GPO that you touch for any reason. GPO backups are incredibly small; you can keep many copies of all your GPOs and not have to worry about disk space for storing these backups.

Keeping backups of GPOs then allows some interesting scenarios. If an administrator makes a change within a GPO and it creates a negative result, you can simply roll that GPO back to the previous settings. Additionally, if someone accidentally (or purposefully) deletes a GPO and that causes problems, you can very quickly slap that GPO back into place with a very fast, very simple restoration wizard. It would be a rare occurrence that you would actually have to run a full operating system recovery process on a Domain Controller server, but could be an everyday task to restore an individual GPO. Let's take a few minutes and make sure that we are familiar and comfortable with backing up and restoring Group Policy Objects.