This PowerShell script helps administrators automatically back up Active Directory Group Policy Objects (GPOs) and generate HTML reports of the current settings. It is designed as part of an IT‑security audit and change‑tracking workflow, especially for environments where Group Policy changes must be logged and recoverable.
The script runs once per day as a scheduled task and performs four main steps:
- Query all GPOs in the specified domain and create an HTML report for each one.
- Back up all GPOs to a local folder, including their configuration and WMI filters.
- Archive the backup into a compressed ZIP file for long‑term retention.
- Send an email report summarizing the backups and the number of GPOs that were processed.
The final HTML report includes:
- A list of all GPO‑backup archives (with file name and size in MB).
- A table showing each GPO name, GpoID, and Backup‑ID.
- A second table showing each GPO name, GpoID, and ModificationTime.
This makes it easy to verify which GPOs were captured and to cross‑check changes later.
How to configure it for your environment
Before running the script, you must adjust these key variables near the top of the file to match your environment:
| Variable | Example value | Description |
|---|---|---|
$Daysback | -90 | Number of days (age) after which old backup archives are deleted (retention window). |
$ADDomain | "domain.tld" | Target Active Directory domain for which the GPO backup is executed. |
$smtpServer | "mailserver.domain.tld" | SMTP server used to send the backup notification mail. |
$smtpFrom | "GPOBackup@domain.tld" | Sender address used for the backup notification mail. |
$smtpTo | "admin@domain.tld" | Recipient address for backup reports or error notifications. |
$messageSubject | "IT-Security Audit: Active Directory Group Policy Backups" | Subject line for the notification mail sent after the backup run. |
$logPath | "C:\\Scripts\\GPO-Backup\\tasklog.txt" | Path to the log file where the script writes execution and error information. |
$ExportPath | "C:\\export\\GPO" | Base export path where the GPO backup data is stored. |
The script also expects:
- Read permissions on all Group Policy Objects in the domain.
- A scheduled task that runs the script once per day.
- An SMTP configuration that can send the HTML email report to the IT team mailbox.
Once these values are set and the script runs, old backups are automatically cleaned up after 90 days, which keeps the archive folder manageable while still providing a meaningful recovery window.
Why this is useful for IT security
Group Policy is a central pillar of Windows security and configuration. Having an automated, date‑based backup and report helps:
- Prove that GPOs were backed up at a given point in time.
- Reconstruct configurations if a GPO is accidentally deleted or corrupted.
- Support compliance and audit requirements by showing that GPO‑backup procedures are in place.
- Detects sudden and unknown changes to Group Policies that indicate compromise (IoC).
Because the script exports both GpoID and Backup‑ID, administrators can later restore or compare configurations using the exact backup‑specific identifiers instead of relying only on display names.
Where to download
You can download the script from GitHub here:
👉 Download the script on GitHub