diff --git a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md index 89e08b0200..f0a70ed787 100644 --- a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md +++ b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md @@ -43,6 +43,8 @@ To complete this procedure, you must be a member of the Domain Administrators gr 4. In the navigation pane, right-click **Group Policy Objects** again, and then click **Paste**. +:::image type="content" source="images/grouppolicy-paste.png" alt-text="The Attack surface reduction configuration" lightbox="grouppolicy-paste.png"::: + 5. In the **Copy GPO** dialog box, click **Preserve the existing permissions**, and then click **OK**. Selecting this option preserves any exception groups to which you denied Read and Apply GPO permissions, making the change simpler. 6. After the copy is complete, click **OK**. The new GPO is named **Copy of** *original GPO name*.