�This step-by-step article describes how use the Group Policy Migration utility (Gpolmig.exe) to migrate a Microsoft Windows NT 4.0 System Policy setting to Windows 2000. Gpolmig.exe is available in Microsoft Windows 2000 Resource Kit.�
Overview of Gpolmig.exe
Gpolmig.exe uses the following syntax:
gpolmig policy_file_path [/list] [/listgpo] [/migrate] [object_type] [name] [gpo]
You can use the following parameters with Gpolmig.exe.
- /list: Use this parameter to list the policy settings in a System
Policy file by object type.
- /listgpo: Use this parameter to list Group Policy objects (GPO) that are
open and available for you to import to. You can only migrate the Windows NT
System Policy settings to an available GPO.
NOTE: Open the GPO to which you want to migrate the Windows NT System
Policy settings in Group Policy Object Editor before you migrate Windows NT
System Policy settings. - /migrate: Use this parameter to migrate the specified Windows NT System
Policy setting. To successfully run this command, you must specify the
following parameters:
- object_type: Use this parameter to specify the type of object that you want
to migrate from the Windows NT System Policy setting. You can specify the
following objects types:
- name: Use this parameter to specify the name of the Windows NT System
Policy object that you want to migrate, for example, default
user.
- gpo: Use this parameter to specify the GPO to which you want to
migrate the Windows NT System Policy settings. You must include the
32-character hexadecimal Globally Unique Identifier (GUID) of the GPO in this
parameter.
How to Use Gpolmig.exe to Migrate a Windows NT System Policy Setting to Windows 2000
How to Create a GPO
To create a GPO in which to migrate the Windows NT System Policy
setting:
- Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and
Computers.
- In the console tree, right-click either your domain or the
organizational unit in which you want to create the GPO, and then click Properties.
- Click the Group Policy tab, and then click New.
- Type the name for this policy setting (for example,
windows policy migration), and then press
ENTER.
- Click the policy setting that you just created, click Properties, and then click the Security tab.
- Click to clear the Apply Group Policy check box for the security groups to which you do not want to
apply this policy setting.
- Click to select the Apply Group Policy check box for the groups to which you want to apply this policy
setting, and then click OK.
NOTE: Make sure that the users and groups have both the Read and the
Apply Group Policy permissions.
How to Open the GPO
To open the GPO to which you want to migrate the Windows NT
System Policy setting:
- Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and
Computers.
- In the console tree, right-click either your domain or the
organizational unit in which you want to open the group policy, and then click Properties.
- Click the Group Policy tab, click the GPO that you want open, and then click Edit.
How to List the Available GPOs
- Click Start, and then click Run.
- In the Open box, type cmd, and then click OK.
- Type the following command (where
policyfilepath is the path to the Windows NT 4.0
policy [.pol] file that you want to migrate), and then press ENTER.
gpolmig policyfilepath\ntconfig.pol /listgpo
For example, if you type gpolmig
c:\policies\ntconfig.pol /listgpo, and then press ENTER, the
following text is displayed:
Using Downlevel policy file: c:\policies\ntconfig.pol
Processing GPOs currently being edited...
Current Group Policy Objects Open
(open the Properties of GPOs and locate the
'Unique Name' to identify the Globally Unique
Identifier, or GUID, that is displayed here)
---------------------------------------------
{F807FFEB-9850-4C37-93EA-750AEF8338E0}Machine
{F807FFEB-9850-4C37-93EA-750AEF8338E0}User
- Record the GUIDs for the "Machine" and "User" entries of
the GPO.
NOTE: In Microsoft Windows Server 2003, the domain name appears in
front of the GUID in the output of the gpolmig \ntconfig.pol /listgpo command.
How to List the Available System Policy Objects
- At the command prompt, type the following command (where
policyfilepath is the path to the Windows NT 4.0
policy file that you want to migrate), and then press ENTER.
gpolmig policyfilepath\ntconfig.pol /list
For example, if you type gpolmig
c:\policies\ntconfig.pol /list, and then press ENTER, the following
text is displayed:
Using Downlevel policy file: c:\policies\ntconfig.pol
Processing Computers and Users in the Policy File...
Computer Policies
-----------------
.default
User Policies
-------------
.default
User Group Policies
-------------------
Staff
- Record the policy setting name and the object type of the
setting that you want to migrate. For example, if you want to migrate policy
settings from the "Staff" group, record the following information:
Objecttype - Group
Name - Staff
How to Migrate Policy Settings
At the command prompt, type the following command, and then press
ENTER.
gpolmig policyfilepath\ntconfig.pol /migrate objecttype� objectname gpo
This command uses the following place holders:
- policyfilepath is the path to
the Windows NT 4.0 policy (.pol) file that you want to migrate.
- objecttype is the type of object
whose settings you want to migrate (computer, user, or group).
- objectname is the name of the
object whose settings you want to migrate.
For example, to migrate the computer settings that are applied
to the Staff group in the example that is described in this article, type the
following command, and then press ENTER:
gpolmig c:\policies\ntconfig.pol /migrate group staff {F807FFEB-9850-4C37-93EA-750AEF8338E0}machine
NOTE: You must open the GPO in Group Policy Object Editor for this
command to run successfully. In Windows Server 2003, you must specify the
domain name in the GUID when you migrate the GPO policy settings.
After you run this command, the following text is displayed:
Using Downlevel policy file: c:\policies\ntconfig.pol
Correct number of parameters specified...
Opened the source policy...
Opened the destination policy...
Performing Migration...
The migration completed successfully.
Troubleshooting
- Ensure that the computer, user, or group whose policy
settings you want to migrate exist in the Windows 2000 domain. For example, if
you want to migrate policy settings for the Staff group, a Staff group must exist in the Windows 2000 domain.
- To migrate Windows NT System Policy settings that have been
created by using a custom template, you must first import the custom template
to the Windows 2000 GPO to which you want to migrate the policy
settings.
- Ensure that the GPO to which you want to migrate the
Windows NT System Policy settings is opened in Group Policy Object Editor when
you attempt to migrate the settings.
- You may notice that the Group Policy migration is reported
as successful, but that the policy changes are not displayed in the GPO to
which you migrated the settings.
This behavior can occur if you try
to migrate Windows NT System Policy settings to a GPO in which no other
settings have been configured. To work around this issue, change a
configuration setting in the GPO, and then migrate the Windows NT System Policy
settings. When the Windows NT System Policy setting has been successfully
migrated, reset the GPO to the configuration that you want to use.
This behavior can also occur if you try to migrate a portion of the Windows NT
System Policy setting to which no corresponding Group Policy settings exist.
For example, you migrate a Windows NT System Policy setting that modifies
settings in the User Configuration portion of the GPO, but you specify
{gpo}machine in the
Gpolmig.exe command line. To work around this issue, run the Gpolmig.exe
command again, and specify the other section of the System Policy file, for
example, specify
{gpo}user. - In Windows Server 2003, you must make an arbitrary change
to the policy after you import the GPO and before you close the policy to make
the changes visible.