LGPO.exe baseline

LGPO.exe /g <backup>

Applies a group policy backup to a machine with LGPO.exe, the CLI route to deploy the GPO baseline without the console.

Run it when you need to apply the policy baseline from the command line: LGPO (Local Group Policy Object utility from Microsoft) imports a GPO backup (the directory with the policy files exported from gpmc.msc) and applies it to the local policy of the machine. It's the automation tool for hardening: the baseline (CIS or the organization's) is applied to machines without opening the policy console — in scripts, in deployment, or in host remediation. In Windows hardening, LGPO is the CLI equivalent of secpol import (136) but for the whole GPO.

Don't use it without the correct backup: LGPO applies the GPO backup — the directory must be the one exported by the console (with registry.pol files, templates, and comments); a malformed backup fails or applies partially. The applied local policy overwrites existing configuration: review the backup before applying (organization GPOs may include unwanted settings on specific machines). And note: LGPO applies the LOCAL policy — in the domain, Active Directory GPO is the correct mechanism; LGPO is for machines outside the domain or for the local baseline. Post-verification (gpresult) confirms what was applied.