gpresult /r – see also rsop
command results in text output, supposedly more complete than RSOP. But RSOP easier to navigate GUI pop-up
group policy editor (local) - see local group policy editor
group policy management editor
gpmc.msc
see also local group policy editor
$AllGroupPolicies
=
Get-gpo
-All
$AllGroupPolicies.Count
$AllGroupPolicies
|
ogv
First step: save a specific Group Policy as an XML file. Let's put it in a GP directory in the My Documents directory
$mydocs
=
[ environment]::getfolderpath("mydocuments")
$basePath
=
"$mydocs\GP\"
[xml]$xml1
=
Get-Content
-Path "$($basePath)DressForSuccess.xml"
read in registry stuff & put into CSV
$result
=
@()
foreach
($item
in
$xml1.DocumentElement.Computer.ExtensionData.extension.RegistrySettings.ChildNodes) {
$result
+=
New-Object
-TypeName PSObject
-Property @{
"name"
=
$item.Name
#"clsid" = $item.clsid
#"status" = $item.status
"image"
=
$item.image
#"changed" = $item.changed
#"uid" = $item.uid
"GPOSettingOrder"
=
$item.GPOSettingOrder
"propertyName"
=
$item.properties.name
"propertyAction"
=
$item.properties.action
"propertyDisplayDecimal"
=
$item.properties.displayDecimal
"propertyDefault"
=
$item.properties.default
#"propertyHive" = $item.properties.hive
"propertyKey"
=
$item.properties.key
"propertyType"
=
$item.properties.type
"propertyValue"
=
$item.properties.value
#"propertyValues" = $item.properties.Values
#"Filters" =$item.Filters
}
}
$result
=
$result
| select name,
image, GPOSettingOrder, propertyName, propertyAction,
propertyDisplayDecimal, propertyDefault, propertyKey, propertyType, propertyValue
$result
| ogv
$result
|
Export-Csv
-Path
"$([environment]::getfolderpath("mydocuments"))\Registry1$((Get-Date).ToString('MM-dd-yyyy_hh-mm-ss')).csv"
-Encoding UTF8 -NoTypeInformation
$allGPOs
=
Get-GPO
-All
$result
=
@()
$i=0
;
$gpocount
=
$allGPOs.Count
foreach
($gpo
in
$allGPOs) {
$i++;
$percentGPOTxt
= ($i/$gpocount).ToString("P")
$gpoName
=
$gpo.DisplayName
Write-Host
"$i
of
$($gpocount)
($percentGPOTxt):
$gponame"
-ForegroundColor Green
[xml]$xml
=
Get-GPOReport
-Name
$gpoName
-ReportType xml
$LinksTo
=
$null
$LinksTo
= $xml.gpo.LinksTo
$j=0;
$linkcount
=
$LinksTo.Count
foreach
($node
in
$LinksTo) {
$j++;
$percentLinkTxtj
=
($j/$linkcount).ToString("P")
if
($null
-ne
$node.SOMName) {
# there always seem to be some null records that aren't visible
in XML file
$SOMPath
=<
$node.SOMPath
$NoOverride
=
$node.NoOverride
Write-Host
" $j
of
$($linkcount)
($percentLinkTxtj):
$SOMName
$SOMPath
$NoOverride"
-ForegroundColor Cyan
$result
+=
New-Object
-TypeName PSObject
-Property
@{
"gpoCount"
=
$i
"gponame"
=
$gpoName
"LinksCount"
=
$j
"SOMName"
=
$node.SOMName
"SOMPath"
=
$node.SOMPath
"NoOverride"
=
$node.NoOverride
}
}
}
}
$result
=
$result
|
select gpoCount, LinksCount,
gponame,
SOMName,
SOMPath,
NoOverride
$result
|
ogv
open
gpedit.msc
after making any changes
gpupdate /force
see also group policy management editor
report, generate for a single GP
HTML
Get-GPOReport - Name"MonroeDoctrine" -ReportType HTML -Path "$([environment]::getfolderpath("mydocuments"))\MonroeDoctrine.html"
XML
Get-GPOReport - Name"MonroeDoctrine" -ReportType XML -Path "$([environment]::getfolderpath("mydocuments"))\MonroeDoctrine.xml"
rsop – Result of Policy - see also gpresult /r
command results in easier to navigate GUI pop-up than gpresult's text output, but gpresult supposedly more complete than RSOP.
list scopes of management (OUs) for all GPOs
$allGPOs
=
Get-GPO
-All
$result
=
@()
$i=0;
$gpocount
=
$allGPOs.Count
foreach
($gpo
in
$allGPOs) {
$i++;
$percentGPOTxt
=
($i/$gpocount).ToString("P")
$gpoName
=
$gpo.DisplayName
Write-Host
"$i
of
$($gpocount)
($percentGPOTxt):
$gponame"
-ForegroundColor Green
[xml]$xml
=
Get-GPOReport
-Name
$gpoName
-ReportType xml
$LinksTo
=
$null
$LinksTo
= $xml.gpo.LinksTo
$j=0;
$linkcount
=
$LinksTo.Count
foreach
($node
in
$LinksTo) {
$j++;
$percentLinkTxt
=
($j/$linkcount).ToString("P")
if
($null
-ne
$node.SOMName
) { # there always seem to be some null records that aren't visible
in XML file
$SOMPath
=
$node.SOMPath
$NoOverride
=
$node.NoOverride
Write-Host
" $j
of
$($linkcount)
($percentLinkTxt):
$SOMName
$SOMPath
$NoOverride"
-ForegroundColor Cyan
$result
+=
New-Object
-TypeName PSObject -Property @{
"gpoCount"
=
$i
"gponame"
=
$gpoName
"LinksCount"
=
$j
"SOMName"
=
$node.SOMName
"SOMPath"
=
$node.SOMPath
"NoOverride"
=
$node.NoOverride
}
}
}
#if ($i -gt 3) {break}
}
$result
=
$result
| select gpoCount, LinksCount, gponame, SOMName, SOMPath, NoOverride
$result
|
ogv
$result
|
Export-Csv
-Path "$([environment]::getfolderpath("mydocuments"))\GPOAllLinksTo$((Get-Date).ToString('MM-dd-yyyy_hh-mm-ss')).csv"
-Encoding UTF8 -NoTypeInformation
Servers
SOM - scope of management - see scope of management
Servers
XML, read Group Policy XML file - see group policy, XML