Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. SYSVOL
  4. domain
  5. Policies
FolderRisk: Do not touch
  • Windows Server

Policies C:\Windows\SYSVOL\domain\Policies

Policies: one {GUID} folder per Group Policy object (the GPT part, replicated by DFSR), plus the PolicyDefinitions Central Store if it exists.

Updated on By AltF4 Formation

What it’s for

A Group Policy object has two parts: a container in Active Directory (name, links, version numbers) and files in this folder. Clients read the file part through the UNC path \\<domain>\SYSVOL\<domain>\Policies\{GUID}. Domain controllers replicate it to each other with DFSR.

What it contains

  • One {GUID} subfolder per GPO, named after the GPO’s identifier. Two exist as soon as the domain is created: {31B2F340-016D-11D2-945F-00C04FB984F9} (Default Domain Policy) and {6AC1786C-016E-11D2-945F-00C04FB984F9} (Default Domain Controllers Policy).
  • PolicyDefinitions, the Central Store for ADMX templates, created by hand if you use it.

Risks and best practices

  • A folder with no GPO object in Active Directory is an orphaned GPO, and a GPO whose folder is missing applies nothing. Compare both lists before cleaning up.
  • Delete a GPO from the Group Policy Management console, never by deleting the folder: the Active Directory object would remain.
  • Permissions are set by the console; do not “fix” them by hand, because a GPO unreadable by computer accounts stops applying.
  • Restore a GPO with Restore-GPO from a Backup-GPO backup, not by copying folders.

Useful commands

Fenêtre de terminal
# Folders present on the SYSVOL side
Get-ChildItem "$env:windir\SYSVOL\domain\Policies" -Directory | Select-Object Name


# GPOs known to Active Directory (name and GUID)
Get-GPO -All | Select-Object DisplayName, Id | Sort-Object DisplayName


# GUIDs present in SYSVOL but missing from Active Directory (orphaned GPOs)
$ad = (Get-GPO -All).Id | ForEach-Object { '{' + $_.ToString().ToUpper() + '}' }
Get-ChildItem "$env:windir\SYSVOL\domain\Policies" -Directory | Where-Object { $_.Name -match '^\{' -and $_.Name -notin $ad }

Folder contents

Folders 2

Report a mistake