Trying to find out who implemented a GPO to the domain

I need to find out who deployed a GPO to the forest. I have the date and time, but need to recover a previous GPO if possible.  Any suggestions would be greatly appreciated.  URGENT REQUEST.
Who is Participating?
SandeshdubeyConnect With a Mentor Senior Server EngineerCommented:
Ensure that demoted DC is not online in production network else it will create problem.
Mike KlineCommented:
It involves auditing and getting into the security logs on your domain controllers.   See this question I helped with

Do you have backups of the GPO in question?   If you do you can restore that.


SandeshdubeySenior Server EngineerCommented:
If auditing is enable you can easily track the same event id 566(Win2003) or 5137(Win2008) will be logged if GPO is created.You can refere belwo link for detail info about the event id.

Monitoring Group Policy with Windows Auditing

Group Policy Auditing: Myths & Facts

If you have backup as mike suggested you can restore the same.
Back Up, Restore, Copy, and Import:
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

cgooden01Author Commented:
I am looking into further with the suggestion provided, thanks for the responses, I will get back with my response with the next 48 hours.  Appreciate the inputs, will award appoints accordingly
cgooden01Author Commented:
The administrator/engineer prior to me, did not create a backup of an GPO, and if so its not in a location where i can find it.   This is Systems Administration 101.  So my best chance is to turn back on the DC that was decommissioned, disabled any GPO so its not propagated to the DC and maybe i can find it there. The new ones are virtualized and this that is to be turned back on was a Physical machine that was the PDC.
cgooden01Author Commented:
It can also be noted that the hopefully I can scanned the network for any file that has the GUID of the Group Policy Object and that should be the backup copy.  Hope I have some luck
cgooden01Author Commented:
Yes, sure thing, that would create an issue for sure.  Thanks for the reminder. I will close this now, since i have concluded what i needed.  Appreciate the assistance and reminder.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.