Every copied policy is perfect exactly once: on the day you import it. Then the months start editing. A technician relaxes a setting 'just for today', a Windows feature update adds two new policies nobody reviewed, and a fresh PC gets imaged from last year's backup. Drift is not a failure of the copy — it is what copies do over time. This guide is the review habit that keeps it visible.
Drift has three authors, and it helps to name them. People change settings locally and forget. Windows itself changes: feature updates ship new Administrative Template settings whose defaults may not match your intentions. And your own process drifts when a new PC is built from an old baseline backup instead of the current one. None of these show up as errors — the PCs just slowly stop being identical. The fix is not a tool you buy; it is a review rhythm you keep.
A domain GPO re-asserts itself at every refresh; a copied local policy asserts nothing — it simply sits where you left it while the world edits around it. Local administrators (including well-meaning support staff and 'optimising' utilities) can change any of it, and nothing phones home to tell you. Accept this and drift stops being a surprise: the question is never whether your copies drift, only how long they drift before you look.
gpresult /h reports from eachEach Windows feature update can add new policy settings and occasionally change what an old setting controls. After a fleet-wide version upgrade, open your baseline in the editor and walk the sections you care about — security, updates, privacy — reading for new entries marked with the new version. 'Not configured' on a brand-new setting means the Windows default rules, and the default is a product decision, not yours. Fold deliberate choices into the next baseline version rather than discovering them during an audit.
Drift thrives on ambiguity about which backup is current. Kill the ambiguity: every baseline export gets a version number and a date (Office Baseline v5 — 2026-10), a one-line changelog (what changed and why), and a single home — one folder on the share, one offline copy. Old versions stay, read-only, for rollback; they are never the folder a tired technician grabs at random. If two folders both claim to be 'latest', you do not have a baseline — you have a rumour.
Domain fleets do not suffer local edits the same way — refresh re-asserts the GPO — but they drift at the management layer instead: GPOs edited directly instead of through change control, test GPOs left linked to production OUs, and 'temporary' security filtering that became permanent. The same quarterly hour covers it: export GPMC settings reports, review the link list per OU, and reconcile against your register. Different layer, same medicine.
See the policy backup leave one PC and land on the next — the complete transfer, done live.
▶️ Watch Full VideoQuarterly is the practical rhythm for a small fleet: re-export the golden baseline, sample a handful of PCs with gpresult reports, and re-apply where settings have drifted. After any Windows feature upgrade, do one extra review — new policy settings arrive with it.
There is no built-in free monitor for local policy drift. The workable pattern is scripted sampling: export a PC's local policy with LGPO, parse it to text with LGPO /parse, and compare against the parsed baseline. Anything beyond that is what management platforms — or a domain — are for.
Decide whether the change was right. If yes, promote it: make it on the golden PC, export a new baseline version, and roll it everywhere. If no, re-apply the baseline and record why. Drift logs exist so good fixes become policy instead of folklore.