Active Directory Permissions to Back Up Group Policy Objects

Hi ​@Rafter,

I gathered some info internally that may help with this:

To back up Group Policy Objects (GPOs) using PowerShell cmdlets, you need appropriate permissions on the Group Policy objects. Specifically, you require:

1. Minimum Permissions Required

• Read and Backup permissions on the GPOs you want to back up.

2. Recommended Group Memberships

To successfully back up GPOs, you should be a member of one of the following groups:

• Domain Admins (recommended)
• Enterprise Admins
• Group Policy Creator Owners (if you are the owner of the GPO)
• A custom security group with at least the following permissions:
  • Read
  • List Contents
  • Read Permissions
  • Backup Group Policy Objects

Hello

I have run into the same issue yesterday

Hoping that the original poster can confirm whether the suggestion here worked or was there some alternative

Thanks

Hi,

To be honest, no I’ve not found a working solution at the moment, but more down to time.

The recommendation of Domain/Ent Admin is just ridiculous, no service account in our org is a Domain Admin.  I’ve attempted with the Group Policy Creator Owners builtin role, which wouldn’t be ideal, but that doesn’t appear to work anyway.

A custom security group is the way we’d like to go, but setting that on existing GPO raises a lot of concern and remembering to set it for every new GPO will be a change nightmare as there’s no inheritance on the permission.

So I’ve left if completing with errors for now, hoping someone else comes up with a solution! 😀

All that said, it also failed with a brief test with domain admin membership (size went up, but still errors - may just be one item with incorrect privileges I guess), which needs investigation and may help work out using lesser privileges with GPO CreatorOwner.

Keep me posted if you find a resolution before we have the time to resolve!

Here’s a quick update, I thought I’d take a look in the logs, when Domain Admin, it failed with path length error, so it has completed most GPOs.

I notice release update 11.36.49, released a couple of days ago.  One hotfix reference to resolving issues with GPO backups, so that’s going to be the next test, applying the update!

Getting it working with a domain admin account in dev environment will at least help look at the permissions after that.

all, is there a way to disable the Group Policy Objects part of the AD backups ?

Hi Rafter

Just to let you know, I had two failing DC backups (have 19 different domains for various customers)

Applying 11.36.49 has resolved this issue for one of the AD backups - the other one is still failing it appears to be always on the same GPO

My AD expert says he can back it up using the Powershell command in the logs

I have a ticket open, we will see what happens

​@atitagain - I’m sure I saw a parameter in the documentation when reading last week - of course, I can’t find it now

​@jracjdb2 if you find this parameter again would you mind sharing.

thanks