How to Reset Default Domain Policy and Default Domain Controllers Policy

Applies to: Windows Server 2025 / 2022 / 2019 / 2016 / 2012 R2 / 2012 / 2008 R2 / 2008 / 2003 R2 / 2003

Dcgpofix.exe recreates the two default Group Policy Objects that are created with an Active Directory domain: Default Domain Policy and Default Domain Controllers Policy.

This tool is intended for disaster recovery. It should not be used as a normal troubleshooting shortcut because it resets the default GPOs to Microsoft-defined defaults and can overwrite settings that were intentionally configured in those policies.

In This Article

• 1. What Dcgpofix Restores
• 2. Before Running Dcgpofix
• 3. Reset Default Domain Policy
• 4. Reset Default Domain Controllers Policy
• 5. Reset Both Default GPOs
• 6. Validate the Result
• 7. Important Limitations
• 8. Key Takeaways

1. What Dcgpofix Restores

Microsoft documents dcgpofix as a tool that recreates only the default GPOs for a domain. It does not recover custom GPOs created by administrators.

• Default Domain Policy normally contains the default account policies such as password policy, account lockout policy, and Kerberos policy.
• Default Domain Controllers Policy normally contains domain controller user rights and audit policy settings.

2. Before Running Dcgpofix

Before resetting either default GPO, first confirm that the policy is actually damaged or unrecoverable. If you have a valid Group Policy backup, restoring that backup is usually preferable because it preserves your environment-specific settings.

• Back up the existing GPOs if they can still be read.
• Document any custom settings currently stored in the default policies.
• Confirm Active Directory and SYSVOL replication are healthy.
• Run the command from an elevated Command Prompt with appropriate domain permissions.

3. Reset Default Domain Policy

To recreate only the Default Domain Policy:

dcgpofix /target:domain

Confirm the prompts carefully. This resets the default domain GPO content and can remove custom settings that were added to that policy.

4. Reset Default Domain Controllers Policy

To recreate only the Default Domain Controllers Policy:

dcgpofix /target:dc

5. Reset Both Default GPOs

If both default policies must be recreated:

dcgpofix /target:both

Use this only when both default policies really require recovery. Resetting both policies increases the amount of configuration that must be reviewed afterward.

6. Validate the Result

After dcgpofix completes, validate the result before considering the recovery finished.

• Open Group Policy Management and confirm both default GPOs are present as expected.
• Review the settings inside the recreated policy and reapply any required environment-specific configuration.
• Confirm Active Directory and SYSVOL replication are healthy between domain controllers.
• Verify the expected policy is applied to test systems and domain controllers.
• Review the System and Group Policy event logs for new errors.

7. Important Limitations

Dcgpofix is not a general-purpose GPO restore tool. It does not restore custom GPOs, and Microsoft notes that some security settings in the recreated Default Domain Controllers Policy may not exactly match the settings created by a clean domain controller promotion.

For that reason, Microsoft recommends using dcgpofix only in disaster-recovery scenarios and reviewing the resulting security configuration after the reset.

8. Key Takeaways

• dcgpofix /target:domain recreates Default Domain Policy.
• dcgpofix /target:dc recreates Default Domain Controllers Policy.
• dcgpofix /target:both recreates both default GPOs.
• Use dcgpofix for disaster recovery, not routine Group Policy troubleshooting.
• Review and restore any required custom security settings after the reset.

References

• Microsoft Learn – dcgpofix
• Microsoft Learn – Dcgpofix does not restore all Default Domain Controllers Policy security settings to the original state