This post is part of a series of posts about Advanced Group Policy Management. If you want to see the other post in this series you can use the links below:
- Introduction to Advanced Group Policy Management (a.k.a AGPM) v4
- How to install the Advanced Group Policy Management Client v4
- How to install the Advanced Group Policy Management (AGPM) Server v4
- How to configure the AGPM client via Group Policy to automatically connect to the AGPM server
- Delegating permission to Review/Edit GPO’s in AGPM
- How to create make changes to Group Policy Objects in AGPM
- How to makes changes to existing uncontrolled GPO’s in AGPM
Editing existing uncontrolled GPO’s in AGPM
If you are deploying AGPM into an existing environment (and you probably are) then you will probably want to editing you existing GPO’s. Any GPO that is not managed by AGPM is called an “Uncontrolled†GPO and as such will not be touched until it is specifically made into a “Controlled†policy.
Step 1. Logon as Alan to a computer that has GPMC and the AGPM client
Step 2. Open GPMC and click on Change Control and then then Uncontrolled tab then right click on the GPO you want to “Control†and then click on Control…
Â
 Step 3. Add a comment to the GPO as its initial comment then click OK
Â
This Group Policy is now “controlledâ€
 
Hopefully this has series given you enough of an introduction to AGPM to get it installed and start to perform basic changes and approvals to GPO setting …
If you want more information on Advanced Group Policy Management then here is a list of link to pages I have found useful:
Microsoft MDOP Blog
TechNet: Overview of Advanced Group Policy Management
TechNet: A Video tour of Advanced Group Policy Management
TechNet: Technical Overview of AGPM
TechNet: What’s New in AGPM
TechNet: Choosing Which Version of AGPM to Install
TechNet: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0
TechNet: Operation Guide for Microsoft Advanced Group Policy Management 4.0
Group Policy Blog: Importing and Exporting with AGPM
Blog Post: How to makes changes to existing uncontrolled GPO’s in AGPM http://bit.ly/bgh2bm
Be careful when importing your GPOs into AGPM.
If you have GPO permissions set with anything other than Read/Apply Group Policy, AGPM will remove those settings from the production policy when the policy is imported and AGPM will replace them with the settings as defined in the AGPM Production Delegation tab.
If you need to scope polices to specific users or security groups of users, you need to ensure that you have Domain Computers listed in the AGPM Production Delegation tab with Read access. this will ensure that all imported GPOs get the Domain Computers Read rights added to them. Otherwise, GPOs that only have users scoped will not be applied, as the computer account needs access to read the GPO when the user logs in.