Thanks to a thread on our GPOGUY.COM GPTalk Mailing list, I decided it was time to crack open our GPMC PowerShell module and make a couple of updates. The most significant of these is two new cmdlets:
Get-SDMGPOOwner
Set-SDMGPOOwner
As the name implies, these two cmdlets let you retrieve and set the owner id (AD user or group) on a GPO. This is not something that is exposed in either t…
Now that Windows 8 is out (or almost out), the inevitable questions will arise about introducing it into your Group Policy Management world. As with previous versions of Windows, the approach with Windows 8 (and Server 2012) will be similar. Since Windows 8 and Server 2012 will be introducing more new settings into Group Policy, you’ll need to use the GPMC and GP Editor versions that come wit…
While much is changing in Windows 8, the changes related to Group Policy are more modest. One of these modest changes is in the Resultant Set of Policy (RSoP) functionality, exposed through the Group Policy Results Wizard in GPMC. This wizard was always my first “go-to” tool when trying to troubleshoot GP Processing problems, and they’ve made it more useful in Windows 8.
The first thing you’…
One of the challenges of the GPMC’s reporting is that it is not easy to find GPOs that have had Deny ACEs (Access Control Entries) set on their delegation. Deny ACEs are typically used to deny a particular user, computer or group from applying a GPO. I always recommend that they’re used on an exception basis, for the very reason that they are hard to spot after the fact and can cause increased…
WMI Filters have been available as a mechanism for filtering the effects of Group Policy Objects (GPOs) since Server 2003 & XP shipped. They are a valuable tool in your Group Policy Management arsenal. As the name implies, WMI filters allow you to filter the effects of a GPO based on queries that execute against the WMI repository on a given client machine (server or workstation). A WMI…
When we created our GPMC PowerShell cmdlets in 2008, they made it easy to get at GPMC functionality within PowerShell v1. When Microsoft shipped Windows 7/2008-R2, they also provided their own set of GPMC-related cmdlets within their GroupPolicy module. At the time I assumed that most folks would continue to use our cmdlets on PowerShell v1 and especially on non-Win7 systems, but as it turns…
Sometimes I’m reminded that, even though Microsoft has been shipping their Group Policy PowerShell module for a while now, it is missing some key functionality. Fortunately, it took someone else asking me a question about how they could script something in PowerShell to realize that our SDM GPMC cmdlets, which have been around since about 2008, have a pretty good set of functionality even in t…
Sometimes you want to know how many GPOs you have in a domain. Powershell provides a way to do this quickly and easily. Earlier today I tweeted about the way to do this in Windows 7 or Server 2008-R2, using the Microsoft-provided “GroupPolicy” PowerShell Module. Its as simple as:
(Get-GPO -All).Count
However, if you are not yet on these newer OS versions, you can still get this information from…
GPO Backups and Windows version sensitivity
