I have configured local Group Policy Objects on a Windows 10 Enterprise machine. After that, I exported these GPOs with the Microsoft tool LGPO
with:
LGPO.exe /b [path]
This all works fine. Now I used this GPO export to import it on a second installation (identical), like so:
LGPO.exe /g [path to export]
Everything seems to work as expected, there are no errors during the process. After that, I updated the policies like
gpupdate /force
I can tell that some policies did in fact apply correctly, but some didn't. After looking into gpedit
, I found that some of the policies regarding the "Security Template" did in fact not import (but some did). Why would this happen? I used the same technique before and it worked as far as I remember.
After further investigation into the LGPO export, I found that the settings regarding the Security Template are found in this file:
[Export-ID]\DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf
.
This file is structured like this:
[Unicode]
...
[System Access]
...
[Event Audit]
...
[Registry Values]
... <-- These registry values listed here are not imported at all
// some examples
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,"1"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,"2"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,"1"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,"1"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,7
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1,"1"
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLockedUserId=4,1
[Privilege Rights]
...
[Version]
...
So, how come that the list of settings stored in the "Registry Values" section does not import correctly?
Edit:
I also tried to reinstall the second windows machine, but still no luck.
GptTmpl.inf
can be found in the policy editor (gpedit) underComputer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options
./s
does not change anything. This is basically what is done behind the scenes when doing the full import via/b
. But I've also tried to do it seperately, but it didn't change the outcome. Showing the whole output via/v
gives some information, but basically just shows that everything worked fine./s
) it states in the events that no new settings were applied.