Maintaining a large number of GPOs can be very tedious and inefficient. Merging them can lead to reduced complexity, making maintenance and troubleshooting simpler and less time-consuming.
GPOs with the following traits make excellent candidates for merging:
The same settings or policies configured in multiple GPOs.
Small GPOs that have only one or two settings.
You have the following options when merging the GPOs:
You can create a new GPO that contains the merged data from the source GPOs.
You can overwrite the data of either source GPO with the merged data from both of the source GPOs.
You can overwrite the data of a non-source GPO with the merged data from the source GPOs.
You can only merge the settings from the source GPOs into the merged GPO. The other GPO attributes are handled as follows:
|
GPO Attribute |
Merged GPO is new |
Merged GPO created from other GPO |
|---|---|---|
|
Links |
Empty. |
Links from the original GPO will be retained. |
|
Delegations |
Default delegation and security information. |
Delegation and security information from the original GPO will be retained. |
|
WMI Filter |
Empty |
WMI information from the original GPO will be retained. |
|
GPR Security |
Default GPR Security information |
Original GPR Security information from the original GPO will be retained. |
Other things to consider before merging GPOs:
You can only merge two GPOs at a time. The first GPO that you select to be merged will be considered the primary GPO; the second GPO that you select will be considered the secondary GPO. During the merge, if there is a settings conflict between the source GPOs, the primary GPO’s settings will be used; however, you can override this default behavior and manually select which setting should be merged.
Both GPOs to be merged must come from the GP Repository and must come from the same domain.
You cannot merge GPOs in an untrusted domain.
Third-party settings, such as extension snap-ins, cannot be merged.
To merge the Advanced Audit Policy settings, both source GPOs must have been created in the same language as that used by the computer performing the merge.
The Comment attribute of Administrative Template files are not saved from either source GPO.
You must have the following permissions before you can merge GPOs:
The GPO Editor role on the domain or category that contains the source GPOs.
If you want to preview the GPO before creating it, you must have the Delete GPO permission on the category where the target GPO will be created or overwritten.
To merge two GPOs:
Log on to a GPA Console computer with an account that has permissions to modify GPOs.
Start the GPA Console in the Group Policy Administrator program group.
In the left pane, expand GP Repository and right-click the domain or category that contains the GPO that you intend to merge.
Select Merge GPOs and use the browse dialog to select the source GPOs.
Click OK.
If you want to create the merged GPO in a different container, do the following:
Select Create a new GPO in this container and then browse to the container and select it.
Type a name for the merged GPO in the New GPO name field.
If you want to replace a GPO with the merged GPO, select Overwrite this GPO and then browse to the GPO you want to replace and select it.
If you want to pick which settings to merge, do the following:
In the Customize Settings pane, choose Select Settings Manually to Merge.
This will open a granular configuration window that displays the two GPOs side by side with the different categories of settings. Potential conflicts appear in red text. Under the Select Settings Manually to Merge option, you can change which GPO has the Higher Priority. The highest priority GPO will have all the settings selected.
Select the settings granularity that you require in the different categories from the two GPOs to configure the settings output of the merged GPO.
If you want to merge all settings, select Merge All Settings.
HINT:If you want the merged GPO to inherit the settings from the secondary GPO by default, you will have the option to select Set "<GPO Name>" GPO to higher priority during merging.
If you want to delete one or both of the source GPOs after merging the settings, select Delete Source GPO.
If you want to see a preview of the merged output before executing the merge, click Preview when you finish choosing your settings for the merged GPO.
Click Commit to create the merged GPO after previewing the pending configuration.
If you want to bypass the preview, click Merge instead of Preview.