Group Policy Freeware Utilities
Note–these tools are largely unsupported but if you do have questions or issues using them, check out our Freeware Support Forum
Registry.Pol Viewer Utility 1.5 (Last Updated January 2017)
This utility provides read-only access into the registry.pol file (or any other .pol file). Registry.pol is the file that GP uses to store registry-based policy settings made by Administrative Template, Windows Firewall, Public Key Policy, AppLocker, Software Restriction Policy or Disk Quota policy. Updated to allow browsing by GPO name as well as file path.
This utility is designed to allow you to discover vulnerable “cpassword” entries in GP Preferences settings across your AD domain. Once discovered, you can use the utility to optionally remediate those cpassword entries (remove them from the GPO). The utility creates GPO backups of any GPOs you plan to remediate, prior to remediation.
This is a Group Policy Client Side Extension (CSE) DLL and corresponding MMC snap-in that allows you to add a DSC Management Object Format(MOF) file and DSC Resources to a GPO. They can then be targeted and delivered using standard Group Policy methods and applied to Windows Servers or Workstations that are members of an AD domain using the DSC configuration engine.
Group Policy Health Reporter 1.9 (Last Updated January 2017)
GUI utility that lets you quickly and easily determine Group Policy processing health against a remote computer. Reports out quick “red or green” status of GP processing on end-nodes and provides detailed listing of GPOs that apply to a given computer or user and which Client Side Extensions have run.
This GUI utility lets you quickly and easily find GPOs in a domain that have Deny Access Control Entries set on them. Runs on Win7 or Server 2008-R2 with .Net Framework 3.5.
Description:These cmdlets wrap the functionality around managing Group Policy Objects available within the GPMC, into handy PowerShell cmdlets. The latest version comes with 27 cmdlets (in the Vista\Windows 7 version) for performing GPO management tasks like creating and deleting GPOs, linking them to sites, domains and OUs, modifying GPO and SOM security and backing up, importing and restoring GPOs. For more information on using these cmdlets, check out Darren Mar-Elia’s Group Policy Blog
This free set of cmdlets is a great compliment to our commercial GPExpert Group Policy Automation Engine, which provides a cmdlet for modifying the settings within a GPO–something GPMC can’t do! You can get more information on the GPAE on the Products Page.
Requirements: This utility requires .Net 2.0 and PowerShell 1.0 or PowerShell 2.0 to be installed before installation. It also requires GPMC (which requires .Net 1.1 or later) to be installed on the system where the cmdlets run.
The Clean Registry Policy utility is a command-line tool for listing and removing registry policies, preferences and Software Restriction Policies. You can list each type of registry policy from the tool and then optionally remove each type (or all types). This tool is unique in that normally there is no easy way to remove preferences–those Administrative Template policies that fall outside of the four special policy keys that Microsoft provides. Preferences tattoo the registry until they are explicitly removed or disabled. This utility lets you remove all preferences that were previously set on a machine. In addition, this utility can help you clean a system that has been removed from a domain and still has “orphaned” registry policy entries that are causing problems. You can view all of the command-line switches available on the tool by typing cleanregpol /?.[>
This utility scans all GPOs in your domain and looks for Deny ACEs . If it finds them, it reports out the GPO, the Trustee (i.e. user,group, computer) that is assigned to the ACE and the permission that is set to denied (usually permGPOApply for Read and Apply Group Policy permissions).
Powershell cmdlets to get GPO version information and also to “Touch” a GPO’s version to force clients to think the GPO has changed.
Validates GPO WMI Filters against live systems to make sure that the filter you write will pass or fail as expected. Provides timings that let you identify WMI filter impact on GP Processing.
This .vbs script will disable the local GPO on a given pre-Vista system (Vista comes with an Admin. Template policy to do this). On Win2K, XP and 2003, there is no centralized way to disable the Local GPO.
You can use this script in a Group Policy Startup Script to accomplish the task. Note that because this script edits a protected file on the local system, a normal user account will not be able to successfully run this, so you won’t be able to deliver it as a logon script. That is why I recommend running it as a startup script.
This utility simplifies the creation of the “Central Store” for storing Vista ADMX/ADML templates. Its a very simple utility.
GPSI “GYPSY” VIEWER UTILITY
Within native tools, there is no way to quickly get an at-a-glance view of all applications deployed via Group Policy Software Installation (GPSI) policy across a domain. This simple GUI utility lets you quickly view all applications that have been published or assigned (or removed) using Group Policy, within a domain. With the newest version, you can also print the list of applications to a report or save it as a .csv file.
This handy little utility is designed to quickly and succinctly report the last time computer and user Group Policy was run on a local or remote system. If there has been more than one user logged onto the system, the tool will report GP processing times for all users found.
DISCLAIMER: Everything posted here is offered as is. By downloading it, you accept full responsibility for testing to ensure it does not cause any problems in your own environment. There is no warranty on any of the code or files on this page, so it’s up to you to make sure it’s safe for your environment. Please don’t repost or re-use the tools or content elsewhere unless you get prior approval from the author (all GPOGuy tools are written by me unless otherwise noted). Many of the files on this page are offered as freeware (unless otherwise noted by the author), and as such should not be sold by anyone else.