We see that the Group Policy Object (GPO) backup feature is enabled by default on Active Directory clients. We would appreciate an explanation as to why this decision was made, particularly given that the feature appears to require an additional license for full functionality.
The automatic activation of this feature has led to complications:
- Some environments are now reporting backup jobs as “Completed with errors” due to attempts to back up GPOs without meeting the necessary prerequisites.
- In cases where the customer does not wish to back up GPOs, there is no straightforward option to disable this functionality. Instead, we need to add an “Additional Setting” in the Properties.
- If the customer does wish to use GPO backup, they must ensure that the service account has the appropriate permissions, modify registry settings to support long paths, or create specific folders.
- Should the customer later require a GPO restore, it appears that an additional license is necessary. This requirement is not clearly communicated in advance.
The message “GPO objects restore belongs to the enhanced Active Directory protection and requires an additional license” raises concerns about transparency and ease of use.
We request your answers/comments:
1. How to disable GPO backup in a streamlined manner.
2. The exact licensing requirements for GPO restore functionality.
3. Any planned improvements to simplify this process for customers.
Thank you for your patience and understanding.
