Every GPO horror story starts the same way: a confident edit, applied immediately to everyone, with no way back. A backup made before the edit costs less than a minute — and it is the entire difference between an experiment and an incident.
Group Policy changes are instant and fleet-wide the moment a client refreshes. That power deserves one small ritual: before you edit a working GPO, back it up. In GPMC, right-click the GPO → Back Up, choose a folder, add a comment saying what you are about to try, done. The backup captures the GPO's settings as they are at that moment, and Restore (right-click the GPO → Restore from Backup, or Manage Backups) puts them back exactly. This page is deliberately short on theory — the habit is the content.
Example — the comment field is where future-you learns what this backup was for. Use it.
A GPMC backup stores the GPO's settings — both halves, including Preferences — in a folder you choose. It does not store the links (which OUs it was attached to), the security filtering, or the WMI filter link; those are properties of the domain, not the GPO's contents. Restoring a backup therefore restores what the GPO says, while where it applies stays as it currently is. That distinction matters in recovery: if a disaster involved deleted links or changed filtering, the backup alone will not rewind those — re-check the Scope tab after any restore. Keep backups somewhere that is itself backed up, with a folder per GPO and the date in the folder name; a backup living only on the DC's desktop is one disk failure away from being a story you tell juniors.
gpupdate /force, check the setting, check gpresult /r.gpupdate /force on affected machines, and the experiment never happened.Notice what this routine replaces: the frantic screenshot-archaeology of "what was this set to before?" A backup answers that question perfectly, forever, for free.
For structural surgery — rebuilding a settings pack, merging GPOs, a migration — do not edit the live GPO at all. Create a new GPO, build the new world inside it, test it on a pilot OU, and only then swap the links: unlink the old, link the new. The old GPO remains untouched as your instant rollback — restoring is then just re-linking. This copy-and-swap pattern, plus backups before small edits, covers both sizes of change. (Copying GPOs between PCs and domains — migration tables, LGPO on workgroups, scripted rollouts — is a bigger topic with its own tutorial on this channel; the pointer is deliberate, because backup discipline is what makes all of that safe.)
Storage is cheap and regret is expensive: keep the last several backups of important GPOs, not only the newest. A change can look fine for a week and reveal its cost on the eighth day — the backup from before last week's edit too is the one that saves you then. Monthly, copy the backup folder into whatever protects the rest of your server data. And once — just once, on a quiet afternoon — actually practise a restore on a test GPO, so the first time you ever click Restore is not during an incident with the office watching. Insurance you have rehearsed is insurance; insurance you have only bought is a hope.
User policy and computer policy explained live on a real domain controller — create, link and test your first GPO with the video.
▶️ Watch Full VideoNo. A backup stores the GPO's settings only. Links, security filtering and the WMI filter assignment live in the domain and are not part of the backup — after a restore, quickly re-check the Scope tab to confirm the targeting is what you expect.
In GPMC, right-click the GPO and choose Restore from Backup (or open Manage Backups on the Group Policy Objects node), point at the backup folder, and finish the wizard. Clients pick the restored settings up at the next refresh or a gpupdate /force.
Keep several generations of your important GPOs, not just the latest — problems sometimes surface a week after a change. Store them in a dated folder structure that is included in your normal server backup.