Demoting a DC and Group policy, help needed.

Question

Hi all,
so we have 3 domain controllers, lets say dc1,dc2 and dc3. We have the 3rd line assistance from another company, they have advised the following.... 
SO the stages will be
1) Can you please go through all the GPO's in DC3 and consolidate what you need and what you do not need, you need to extensively cross reference this with DC1 and DC2, this is something you have to do. As I will not know what you need and what you do
not. You can do this by logging into each domain controller and opening up the settings of each GPO and cross referencing.
2) Once the above is done, we will consolidate the GPO's to a central repository in your domain
3) Backup Sysvol directory and Netlogon folder in DC3
3) Proceed to dcpromo DC3 out of the domain
4) Test connectivity if clients to the AD
5) Add the additional Server options
6) All of the above can be done during office hours.
it was my understanding (perhaps wrongly) that the group policies were not on the individual Domain Controllers but in Sysvol and as such replicated anyway?
any advice would be very much appreciated.

Answer 1

> I am being told that our Group policies are different across different
> Domain Controllers and to my knowledge that's impossible as we have
> discussed it should be in the replicated Sysvol.
Ok, that's a common problem. Fix it and you will be fine:
http//support.microsoft.com/kb/2218556 (for DFS-R Replication of Sysvol)
http://support.microsoft.com/kb/315457 (for NTFRS replication)
> I'm a bit lost on the central repository aspect but prior to saying it
> makes no sense I just wanted to check my understanding, especially with
> an MVP!
I agree. Talking of a "central repository" fro group policy doesn't make
sense, because group policy from the very beginning lives in AD and
sysvol, which both are kind of "central repository". Seems they don't
really know what they're talking about :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))