0

As part of my organisation's Windows 7 rollout process, we would deploy a Windows 7 image onto a target machine, then manually install LocalGPO on it followed by applying a set of group policies via the following script (right now we have to manually copy in the C:\SETUPGCB\ folder post-deployment) :

echo *************************Change Path LocalGPO*************************
cd /d "C:\Program Files\LocalGPO"
echo *************************Run Policy***********************************
cscript LocalGPO.wsf /path:C:\SETUPGCB\{3AFCFA90-5E1C-4854-ACC8-069399F4E00F}
cscript LocalGPO.wsf /path:C:\SETUPGCB\{8E7E3C0B-1CB5-4F52-A825-832AB93081B6}
cscript LocalGPO.wsf /path:C:\SETUPGCB\{8FBAD1C1-75F0-43C2-818E-FD700AC78D5F}
cscript LocalGPO.wsf /path:C:\SETUPGCB\{042F3731-1FC3-4E51-B06F-31F967E74D1A}
cscript LocalGPO.wsf /path:C:\SETUPGCB\{61A09835-BED1-4573-A599-3E87118754CA}
pause

In order to save the steps of manually installing LocalGPO and running this script everytime we deploy the image to a machine, I am thinking about re-making the Windows 7 image by:

  1. Setting up a new reference Windows 7 system and install any software/modifications specific to my organisation.
  2. Install LocalGPO.
  3. Run the script I showed above to apply group policies.
  4. Execute the "sysprep /generalize /oobe /shutdown /unattend:[my answer file]" command to sysprep the system.
  5. Image and deploy.

My question is will sysprep respect and retain all the group policies I applied when making the image this way? If so that's great. If not, how should I sysprep the system so that I can achieve this goal?

Thank you very much!

P.S. Unfortunately my only experience with setting up group policies (other than the steps stated above) is using gpedit.msc to manually edit items, so I might need some more detailed explanations if modifying the files in C:\SETUPGCB (which contains lots of nested folders, *.xml, and *.pol files) is required...

hpy
  • 845
  • 3
  • 18
  • 28

1 Answers1

1

Everything that I'm finding indicates that Local Group Policy will be preserved, however anything that you're doing in Local Group Policy that might reference an account SID (other than BUILTIN SIDs) is going to be problematic because the machine's SID (and, consequently, any user SIDs) will change after Sysprep completes.

(Presumably these machines aren't going to be joined to a domain. If they are you really should just use Group Policy, instead. Local Group Policy on domain-joined machines makes me weep.)

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
  • Thanks for your quick reply! (1) Can anyone confirm that Local Group Policy will indeed be preserved? (2) I am fairly certain there's no policy being applied that's user specific, but does that automatically mean there are no policies referecing an account SID? – hpy Apr 08 '14 at 14:03