diff --git a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md
index 89e08b0200..f0a70ed787 100644
--- a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md
+++ b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md
@@ -43,6 +43,8 @@ To complete this procedure, you must be a member of the Domain Administrators gr
 
 4. In the navigation pane, right-click **Group Policy Objects** again, and then click **Paste**.
 
+:::image type="content" source="images/grouppolicy-paste.png" alt-text="The Attack surface reduction configuration" lightbox="grouppolicy-paste.png":::
+
 5. In the **Copy GPO** dialog box, click **Preserve the existing permissions**, and then click **OK**. Selecting this option preserves any exception groups to which you denied Read and Apply GPO permissions, making the change simpler.
 
 6. After the copy is complete, click **OK**. The new GPO is named **Copy of** *original GPO name*.