Copying a live GPO to seed a new office works — but you are copying a working object, with its quirks, into a place it was never reviewed for. Starter GPOs exist for exactly this moment: a template that holds your approved baseline settings but can never apply to a single PC, from which each new office's real GPOs are created. Think of it as the master mould, kept in a drawer, instead of photocopying a photocopy.
In GPMC there is a separate node most admins scroll past: Starter GPOs. A starter is a cut-down GPO containing Administrative Template and security settings only — no links, no preferences, no ability to affect any machine. When you create a new GPO 'from a starter', the new object is born with the template's settings already inside. For a multi-branch organisation — the world of the other guides in this series — starters are how the baseline becomes a product: reviewed once, versioned, and stamped out identically at every new site.
Starters live in their own GPMC container with their own folder in SYSVOL. They hold Administrative Templates and security settings — the registry-and-security core of a baseline. They do not hold Group Policy Preferences, scripts, or software installation settings, and they cannot be linked anywhere. That short feature list is deliberate: a starter is the agreed posture of the organisation (lockdowns, update behaviour, password rules) as a reusable object — not a full working policy.
Microsoft once shipped downloadable starter packs; the living route today is to mint your own. Take your most-reviewed, best-behaved baseline GPO, open the Starter GPOs node, and use New — then populate it from the existing GPO (the starter's editor works like a normal GPO editor, restricted to the template sections), or right-click a GPO in some flows to save its settings into a starter. Then name it like a version (Office Baseline Template v5) and record what changed from v4. Your starter set should stay tiny — a baseline, maybe a hardened variant — because a drawer full of near-identical templates is just drift with better filing.
At the new site: create the office's real GPOs using the starter as the source (GPMC offers 'New GPO' with a Source Starter GPO dropdown in the domain, or create-and-import patterns when crossing domains). The new GPO inherits the template's settings as its own — from this moment the two are independent, which is the point: site admins can add their branch GPO (printers, local paths — the branch guide in this series covers that split) without ever touching the master. Ship starters between domains with the same backup mechanism as GPOs: GPMC can back up starter GPOs from the Starter GPOs node and restore them into another domain's starter store.
A starter everyone can edit is a rumour factory. Restrict who can modify starters (their delegation is set on the Starter GPOs container), treat a template change like a policy release — reviewed, version-bumped, announced — and never edit a starter 'just to test something'. Testing happens in real GPOs in a test OU; the template changes only when the organisation has decided something. When the baseline genuinely evolves, mint v6, keep v5, and let new offices start from v6 while old offices migrate through the normal copy-and-test process.
Because starters carry no Preferences, the modern parts of a baseline — drive maps, printer deployment, scheduled tasks — still travel by ordinary GPO backup and import with a migration table. And a starter does not version itself: the discipline of names, changelogs and read-only storage is yours to keep, exactly as with baseline backups in the drift guide of this series. Used well, starters shorten new-office setup and make baselines comparable at a glance. Used as a dumping ground, they are one more folder of mysteries.
See the policy backup leave one PC and land on the next — the complete transfer, done live.
▶️ Watch Full VideoA starter can never be linked or applied — it exists only as a source when creating new GPOs, and it carries Administrative Template and security settings only. Copying a live GPO works too, but it drags a working object (and its history) into the new site; a starter is a clean, reviewed mould.
No. Starters do not hold Group Policy Preferences, scripts or software installation settings. Those parts of a baseline still travel by GPO backup and import with a migration table — starters cover the template and security core only.
Yes — GPMC can back up starter GPOs from the Starter GPOs node and restore them into another domain's starter container. Across domains it is the same carry-a-folder pattern as regular GPO backup and import.