How to Create a Test Lab from a Production Environment Using Hyper-V and GPMC Scripts

Overview:

The steps that follow involve creating a backup of the production group policies and permissions, OU structures, and user accounts. After that backup is created, it is then copied over to the lab environment and imported into the lab Active Directory environment.

These procedures are recommended as a safer alternative to creating a lab using actual system state, P2V, or other backups of production domain controllers. They also are a “cleaner” option, as large environments can contain hundreds of domain controllers, and cleanup operations when using a restore operation in the lab (i.e. metadata cleanup) can be quite extensive. Further, in order to ensure that the lab is properly differentiated from production, the restore method would normally mandate forest/domain renames and compete re-addressing of the IP addressing scheme.

In most cases for lab scenarios, a lab with a similar namespace and imported configurations is more appropriate, and sufficient, as it contains the key AD infrastructure information typically needed for testing.

Detailed Procedures for Creating the Lab AD Environment

Preparations:

1. On a production Windows XP or Windows Server 2003 machine, install the Group Policy Management Console, SP1. This utility can be downloaded here:

https://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=0a6d4c24-8cbd-4b35-9272-dd3cbfc81887

This machine will be used to pull the Active Directory infrastructure information from the production environment. No changes are made to the production environment.

2. Next, also install the GPMC SP1 package on one of the domain controllers in the lab environment.

3. There are two main scripts needed to create the OU and GPO structure in the lab, one for export and the other to import. These scripts are located in the C:\Program Files\GPMC\Scripts directory after installing GPMC.

NOTE: Regarding the steps that follow, GPMC only needs to be installed if you are using Windows 2003 servers. It is available within the OS (Add Features) if you are running 2008 and later. However, the scripts are only included with the version for 2003 as referenced in the link above. If you are using 2008 and later, you’ll need at least one 2003 or XP machine on which to install GPMC. For the source (production), you need to INSTALL the GPMC package - don't just copy the scripts over to an existing machine. Otherwise you will get an "Automation server can't create object" error. For the target (lab), you can just copy the scripts over.

4. Create a folder to accept the files, such as c:\temp\labinfo on the source machine (production side) and also in the lab (target side).

5. From the C:\Program Files\GPMC\Scripts directory on the production side (source), open a command prompt and run the following command which will create an xml and back up all GPO’s:

cscript createxmlfromenvironment.wsf c:\temp\labinfo\production.xml /TemplatePath:C:\temp\labinfo /IncludeAllGroups /IncludeUsers >c:\temp\labinfo\labinfo.log

Note: the above command should be all on one line

(This will store the xml file and the GPO backups in the labinfo folder)

7. Next, copy the contents of the labinfo folder over to the domain controller in the lab (target), in the same location c:\temp\labinfo.

8. From within the labinfo folder on the lab domain controller (target machine), copy all of the gpo backup folders (all of them have GUIDs for names) to the

c:\program files\gpmc\scripts directory on the same lab domain controller:

9. Optional, but highly recommended – take a snapshot of the DC’s in the lab (using Hyper-V) in case something goes wrong, and you want to roll back. Note that you should never use snapshots to backup production DCs that are virtualized, due to risks such as USN rollback. For labs though, it serves as a convenient way to test changes while allowing you to roll back. If you do need to roll back the state of a lab that contains domain controllers, you need to roll the whole lab back to the same point in time. Otherwise, you risk USN rollback, broken secure channels, and other problems. In short, select all the virtual machines, create a snapshot at the same time, and if you need to roll them back, apply the old snapshot to all of them before starting them back up.

10. Open a command prompt and run the following command from within the c:\program files\gpmc\scripts directory on the lab domain controller (target side) to import and create the environment in the lab:

cscript createenvironmentfromxml.wsf /xml:c:\temp\labinfo\production.xml

/CreateUsersEnabled /PasswordForUsers:P@ssw0rd /ImportDefaultGpos

Note: the above command should be all on one line

11. After the script is finished, check the verbose output for errors. Verify that all OU’s, user accounts, group policies and GPO permissions have been imported.

Additional Screen Shots

Production ADUC:

Production GPMC:

Lab ADUC Before Import:

Lab ADUC after Running Script:

Lab GPMC after Running Script:

OU with explicit ACL’s in Production:

OU with Explicit ACL’s in Lab after Running Script:

Limitations

1. Customized ACL’s on OU’s will not import completely due to an API limitation with GPMC. If there are numerous OU’s in the production environment that are using customized permissions, those permissions must be reassigned manually or through the use of additional scripts.

2. User accounts must be located in OU’s on the production side in order to be brought over by the script. The script will not export/import user accounts from the default Users container in the Production environment. If user accounts exist in the default Users container, you may want to move them to an OU before the Export, so that the script will be able to pick them up.