none
GPO generation is not supported for the selected baseline

    Dotaz

  • Hey folks,

    I'm trying to export a small set of group policy settings using the Security Compliance Manager v2 tool and am getting the following error message when selecting to use the GPO Backup (folder) option:

    Group Policy Object (GPO) generation is not supported for the selected baseline.

    My intention is to use this tool to create a policy from scratch with just a few settings.  However, I could not find a way to do this with the tool and created a duplicate policy instead.  I deleted all of the settings from the duplicate policy and introduced my own settings. 

    My goal is to create a GPO so that I can use for deployment with workgroup machines in MDT.

    Any advice on how to get this working?  Or should I take another route?  


    MCITP Windows 7 MCTS Windows Server 2008

    8. února 2012 3:17

Odpovědi

  • Greg;

    I'm sorry but I'm not sure I understand you. Are you looking for a way to create an empty baseline from which you start building your own or are you having trouble with exporting to GPO format?

    For the first,  your best bet would be to start with one of the 'domain' baselines for any of the versions of Windows, they account lockout and password policy settings. You can delete that small number of settings quickly.

    For the second, you'd have to send us the baseline or list the settings that it includes. While exporting to DCM and SCAP is rather picky due to the requirements of those formats, exporting to GPO backup is pretty forgiving. You can list the settings here or send the baseline itself to use at secwish@microsoft.com, if you email it please include a link back to this thread.

    regards

    Kurt


    Kurt Dillard http://www.kurtdillard.com

    8. února 2012 19:56

Všechny reakce

  • Greg;

    I'm sorry but I'm not sure I understand you. Are you looking for a way to create an empty baseline from which you start building your own or are you having trouble with exporting to GPO format?

    For the first,  your best bet would be to start with one of the 'domain' baselines for any of the versions of Windows, they account lockout and password policy settings. You can delete that small number of settings quickly.

    For the second, you'd have to send us the baseline or list the settings that it includes. While exporting to DCM and SCAP is rather picky due to the requirements of those formats, exporting to GPO backup is pretty forgiving. You can list the settings here or send the baseline itself to use at secwish@microsoft.com, if you email it please include a link back to this thread.

    regards

    Kurt


    Kurt Dillard http://www.kurtdillard.com

    8. února 2012 19:56
  • Hey Kurt,

    Thanks for your reply.  My intention is to apply a local GPO that contains only my settings to a workgroup image during MDT deployment.  I was able to work around the issue by creating a blank GPO from the Group Policy Management Console and using the backup feature.  From there, I included the backup in to the GPOPacks folder from MDT.

    I thought the security compliance manager would be a good tool to use for this process, but it looks like the purpose of this tool is not quite in line with my intentions for it.


    MCITP Windows 7 MCTS Windows Server 2008

    8. února 2012 20:00
  • Oh, I see. I think your solution is best if you want to create a completely empty GPO backup.

    Kurt


    Kurt Dillard http://www.kurtdillard.com

    8. února 2012 20:15