Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


  1. Idea – if it comes in through Service now (SNOW), or an improvement you thought of, there needs to be a Ticket created and documented in SNOW. Link this ticket to the "parent ticket" CHG0031690 .
  2. Create an uncontrolled GPO using "change management" utility found in GPO editor. Name it appropriately, see below for guidance. (Creating GPO Walkthrough)
  3. Check the new GPO out, then edit it and check it back in. After each change, it will need to be checked back in and deployed before the changes are reflected in production, see below for guidance. (Editing GPO Walkthrough)
  4. Edit, test using normal procedures. Currently testing procedures is to choose is a test GPO of your choice that is small, then it moves to ITS, then to Campus/Department OU when it is ready for production.
  5. When ready for final production to the final destination, it needs to be "checked-out" and renamed (removing the "_dev/test" part of the name) then checked back in and submitted via a SNOW TICKET (or the same one as from the earlier steps) to MENSA or whomever is responsible for linking the GPO.
  6. OR in some cases, these changes will be rolled into another "parent" GPO to help with performance. Either way, this is to be documented in the SNOW TICKET. If it is rolled into another GPO, MENSA or DCIS will edit the "parent GPO" by checking out, editing, checking in, then deploying it. (Just as was done above) Remember to delete the Testing GPO in this case, as it is no longer needed. DELETE it using the same "change management" tool. The GPO will be placed in Recycle Bin. To complete the deletion you must choose the Destroy action from within the Recycle Bin.
  7. The point at which it is "deployed", it will be LIVE on the domain and will be implemented by all currently linked OUs immediately.


IF you need to change WMI filters or "scoping" of the GPO:

  1. Check GPO out using AGPM (Change control).
  2. Go to "group policy objects" and look for the GPO Prefixed with [AGPM]. (May take a few Refresh actions for this to show up.)
  3. Open that [AGPM]GPO by double clicking it, and change the filtering and/or scoping.
  4. Close GPO window, or click away from it.
  5. Check the GPO back in. This will incorporate the changes into the checked-In GPO.
  6. Finally, Deploy GPO. (The GPO will be active in production when the last modified date and time matches your deployment action.) 


Creating a controlled GPO in AGPM: Advanced Group Policy Management

  1. Right Click on Change Control in Remote APP 'Group Policy Management".
    1. Choose New Controlled GPO.