new-sdmGPO "Marketing Stuff" | add-sdmgplink -Scope "OU=Marketing,DC=Cpandl,DC=com" -Location -1
If you do still need access to the COM interop types, then there is now a -Native parameter on cmdlets that emit these custom objects so that you can revert to the old 1.1 behavior if needed.
The following are the rest of the release notes on the new 1.2 version. Check them out and let us know what you think!
*******************************************************************
Release Notes for SDM Software's GPMC PowerShell Cmdlets, v1.2
July 2, 2008
-------------
#Added -Native parameter to a number of the get- cmdlets, including get-SDMGPO. In version 1.1, these cmdlets emitted native GPMC COM Interop types, which could not be sent to the pipeline successfully. As a result, all of the cmdlets in this release that support the -Native parameter now, by default, emit custom object types to work better with the pipeline. If you need the native GPMC object types, then use the -Native parameter.
#Add 9 new Cmdlets, including:
Add-WMIFilterLink: Links an existing WMI filter to a GPO
Copy-SDMStarterGPO: Copies an existing Starter GPO to a new Starter GPO (Server 2008 and Vista, Sp1 only)
Get-SDMStarterGPO: Retrieves a reference to and information on a named Starter GPO (Server 2008 and Vista, Sp1 only)
Get-SDMWMIFilter: Retrieves a reference to and information on one or all WMI Filters in a domain
New-SDMStarterGPO: Creates a new Starter GPO (Server 2008 and Vista, Sp1 only)
Out-SDMGPSettingsReport: Creates an xML or HTML GPO Settings report
Out-SDMRSOPLoggingReport: Creates and XML or HTML Group Policy Results report
Remove-SDMStarterGPO: Deletes a Starter GPO (Server 2008 and Vista, Sp1 only)
Remove-SDMWMIFilterLink: Removes any WMI Filter linked to a particular GPO
#Added a Name parameter to Get-SDMGPLink. This new parameter lets you search for links by GPO name in addition to SOM. So, you can provide a GPO name and get a list of all the places its linked.
#Added a GPOID parameter to Get-SDMGPO. This new parameter lets you search for a GPO by GUID instead of by name. With this new parameter, you can use this cmdlet to effectively translate from GUID to Name and Name to GUID.
***********************************************************************
Tags:
]]>Check it out!
]]>
]]>
And while the product is not free, you can download a trial copy and use it for up to 10 queries. After that, to buy a copy is, well, cheap if you ask me :). Anyway, check it out and let us know what you think!
Tags:
Group Policy, PowerShell, SDM Software, Group Policy Health
]]>
How old were you when you started using computers?
I was about 15.
What was your first machine?
The first computer that I used was probably a Cromemco multi-user system in High School or the original Apple computer. The first computer I owned was an Atari 800 that I got for Christmas in 1978 :).
What was the first real script you wrote?
Hmm. Well, my first language was BASIC--not sure that is really a scripting language but it approximated that on the Atari. But in terms of real scripting languages it was probably DOS batch.
What scripting languages have you used?
DOS batch, Fastlane FINAL, Perl, VBScript, JScript, PowerShell. Probably missing a couple in there.
What was your first professional sysadmin gig?
My first job out of college, as I struggled to be a bike racer, was part-time warehouse guy and part-time computer guy for a small computer leasing company. I did some basic maintenance and Paradox development. My first real sys admin. job was for an environmental consulting company. When I started, they had a Sun TOPS network based on Appletalk!!
If you knew then what you know now, would have started in IT?
Excellent question. Not sure. IT has changed a lot, there is a lot of things I don't like about it. I think I might have spent more time in dev. if I knew then what I know now.
If there is one thing you learned along the way that you would tell new sysadmins, what would it be?
What worked for me may not work for others, but I made a conscious decision to reach out and help people. This started with the early winnt-bhs mailing list on Compuserve in the mid-90s and continues today. I think this business is all about spreading the knowledge, because there is so much to learn. So, if you want to advance your own career, help others as you learn. It brings many side benefits, including gaining a reputation that might lead to more interesting things than just fixing broken printers :).
What’s the most fun you’ve ever had scripting?
Scripting is one of those things that I did out of necessity, but I can remember a perl script that I had to write to change thousands of machines from static IP to dynamic. I was particularly proud of that at the time. I think now I get the most kick out of developing PowerShell cmdlets. Fun stuff.
Who am I calling out?
]]>
Tags
]]>
Guido has also provided some great feedback on my tombstone reanimation cmdlets so look for a 1.1 version of them very soon!
You can download Guido's PowerShell script here !
Thanks Guido!
Tags
Active Directory, tombstone reanimation, PowerShell, SDM Software
]]>
Then click OK and once the install completes, you will have GPMC!
Tags:
]]>
In my ever increasing thirst for PowerShell knowledge, I thought I would experiment a bit with some Active Directory-based cmdlets this time. The result is two free PowerShell Cmdlets that retrieve and reanimate AD Tombstones (for an excellent backgrounder article on Tombstone Reanimation, check out Gil Kirkpatrick's piece in TechNet Magazine from last September).
You can optionally register for and download these new AD tombstone cmdlets at www.sdmsoftware.com/freeware. Once you download and install the setup, and launch the console file that comes with it, you'll have two new cmdlets at your disposal*:
get-SDMADTombstone
restore-SDMADTombstone
The first cmdlet, most obviously retrieves a listing of all deleted objects in a given domain. You can filter the results using the -Filter parameter to search for a given text string within the DN of the deleted object. The 2nd cmdlet, which does the actual restoral work, is meant to be used with the first one. So, for example, if I have a user "Dick Evans" who was deleted, and I want to restore him, I can issue the following command:
get-SDMADTombstone -Filter Evans | restore-SDMADTombstone
The restore- cmdlet also implements the -whatif parameter, so that you can see what objects will be restored prior to pulling the trigger.
So, I encourage everyone to download and check it out and provide feedback. I look forward to hearing your input.
Have fun!
Tags:
Active Directory, PowerShell, Tombstone Reanimation
* Note: This blog post was edited after the initial posting. Thanks to feedback from Dmitry, I renamed the cmdlets to be singular, in keeping with PowerShell convention, and also changed the output format of the date fields. Otherwise, everything is the same!
]]>]]>
So, bottom line is that if you are running 2003, SP1 or XP, SP2 without IE7, you will still struggle to deploy XMLLite through means other than "sneaker-net" but the good news is that, with these above exceptions, the number of those machines should get smaller and smaller over time.
And just a note that XMLLite is not required at all for GP Preferences on Vista.
Tags:
]]>
Tags
]]>
Tags:
]]>Tags:
Group Policy, Desktop Policy Manager, Creating Secure Desktops
]]>In fact, the only place you will see that delegation, is when you click on the "Group Policy Objects" node within a particular domain, and view the Delegation tab. So, the right to create GPOs in a domain is domain-wide. Now of course, if you delegate to someone the right to create a GPO, it does not necessarily give them the ability to make it "live". That ability requires a different kind of delegation--the delegation of linking. Remember that a GPO can be linked to an AD site, domain or OU. Each of these AD containers has a set of permissions associated with it. One of those permissions is the ability to write to the gpLink attribute on the container, and it is that permission that controls who can link a GPO to that particular site, domain or OU. You can, of course, delegate that permission without having to dig into the bowels of the AD ACL Editor, by using the GPMC--simply by clicking the Delegation tab while focused on a container object and then choosing "Link GPOs" as the permission you want to manage.
The final type of delegation I will mention is the ability to edit GPOs. Regardless of who creates a GPO, there is the separate ability to be able to edit that GPO once its created. When a GPO is created, it gets a set of permissions that are controlled by the defaultSecurityDescriptor attribute on the AD schema groupPolicyContainer object class. That default security descriptor controls which groups have which permissions on newly created GPOs. You can, of course, modify that attribute in your AD environment so that you can control which groups get what rights on all newly GPOs (see KB article http://support.microsoft.com/kb/321476/en-us for more information), but you may also want to modify the ability to edit GPOs after they are created. For that GPMC again provides the answer. You simply need to highlight a particular GPO, choose the Delegation tab and from there you can set permissions for who can edit a GPO or who can edit, delete and modify the security on a GPO. Its also important to note that these permissions are stored on the GPO object itself, not the link or container object. So, while you can link a GPO to any number of AD containers, keep in mind that the permissions on that GPO in terms of who can read and write it remain constant, regardless of where its linked.
Finally, I will mention a slight variation on the GPO delegation I just described. The ability for a computer or user to process a GPO is just a different kind of delegation on that GPO. Namely, by granting a user or computer (or a group to which they belong) the Read and "Apply Group Policy" rights on a GPO, that user or computer is allowed to process that GPO, assuming its properly linked to them within the AD hierarchy. Strangely, this particular delegation is listed in two places within GPMC. If you're highlight a GPO, you will see it under the Scope tab, in the "Security Filtering" listview, and you will also see that same delegation listed on the Delegation tab for that GPO, except that it will say "Read(from Security Filtering)", next to the security principal name to indicate that the permission being granted is really the ability to process the GPO. Confused yet?
Of course, all of these delegation operations are supported in our free PowerShell GPMC cmdlets as well!
Tags:
]]>