Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. SYSVOL
  4. domain
  5. Policies
  6. {GUID}
FolderRisk: Do not touch
  • Windows Server

{GUID} C:\Windows\SYSVOL\domain\Policies\{GUID}

{GUID}: the SYSVOL folder of one GPO (the GPT part) with GPT.INI, Machine and User. The GUID matches the groupPolicyContainer object in Active Directory.

Updated on By AltF4 Formation

What it’s for

This folder is the file part (GPT, Group Policy Template) of a GPO. Its name in braces is the GPO’s GUID, the same as the name of the CN={GUID},CN=Policies,CN=System,DC=... object in Active Directory (the GPC). {GUID} is a pattern: there is one such folder per GPO, and the Group Policy Management console shows the GUID on the GPO’s Details tab.

What it contains

  • GPT.INI: the GPO version and display name.
  • Machine and User: the computer and user settings. You will find Registry.pol (administrative templates), Microsoft\Windows NT\SecEdit\GptTmpl.inf (security settings), Scripts (startup/shutdown, logon/logoff) and Microsoft\Windows NT\Audit\audit.csv (advanced auditing).
  • Preferences: the Group Policy Preferences XML files (Groups\Groups.xml, Drives\Drives.xml, and so on).

Only the subfolders the GPO actually uses exist.

Risks and best practices

  • Editing a file here without the console does not bump the version number: clients assume nothing changed and do not apply it. Edit through the console.
  • A GPT.INI version different from the Active Directory one points at an Active Directory or DFSR replication failure; the console’s Details tab shows it.
  • Resolve the GPO name from the folder before touching it: Get-GPO -Guid.

Useful commands

Fenêtre de terminal
# Name of the GPO behind a folder (example: Default Domain Policy)
Get-GPO -Guid '31B2F340-016D-11D2-945F-00C04FB984F9' | Select-Object DisplayName, GpoStatus


# Tree of one GPO
Get-ChildItem "$env:windir\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}" -Recurse | Select-Object FullName


# HTML report of a GPO
Get-GPOReport -Guid '31B2F340-016D-11D2-945F-00C04FB984F9' -ReportType Html -Path C:\Temp\gpo.html

Folder contents

Files 1

Report a mistake