Group Policy Team Blog

Group Policy Deployment: Core Network Companion Guide

GPTeam — Tue, 18 Dec 2012 23:33:24 GMT

We have a new document in our technet library. The Core Network Companion Guide has a section specifically about Group Policy Deployment. Check it out! Or just take a look at James McIllece’s blog post summarizing the deployment guide companion.

Listing Disabled GPOs in a Forest

GPTeam — Tue, 11 Dec 2012 17:05:00 GMT

This blog post is written by Judith, our technical writer, and based on an old blog post by Jeffrey Snover. (http://blogs.msdn.com/b/powershell/archive/2007/01/11/sorting-out-groupby.aspx) Jeffrey wrote a piece that showed how to sort system services with the Format-Table (ft) cmdlet and the –GroupBy parameter.

This is one of those tidbits that when I come across them I wonder how I can use this for making it easier to create Group Policy reports. So, here’s what I’m thinking:

If you administer Group Policy in a somewhat large enterprise then you’ve probably got hundreds, if not thousands, of GPOs to deal with.

If you’re like me, I used to grab a listing of GPOs, throw the listing into Excel and start playing games with the data. Well, what if you could pretty quickly grab GPO data on the fly and play some games with it?

More importantly, what if you could grab GPO data on the fly, not just for a single domain, but for your whole forest? But wait, you say. We already did that. Actually, I already wrote a blog post on how to list all the GPOs for a forest. And if you haven’t read that, you can find it here: http://blogs.technet.com/b/grouppolicy/archive/2011/06/10/listing-all-gpos-in-the-current-forest.aspx.

But what if you could look for all the GPOs in your entire forest and list them based on the GPO status? In other words, list all GPOs in a forest with the disabled or partially disabled GPOs grouped separately. And you can do this in a single line of Windows PowerShell. Would you find that interesting? If you agree that this would be helpful then read on.

Jeffrey in his blog post explained that the Format-Table cmdlet has a parameter –GroupBy that tells Format-Table to generate a series of tables instead of one big table. These tables will be based on the –GroupBy parameter.

Big note here. Before we get into the guts of the blog post, you need to remember to import both the Group Policy and Active Directory modules before running these cmdlets. In other words, GPMC is installed on server or client and Active Directory role is installed on server or AD tools are installed on client. Then from the Windows PowerShell command prompt, I need to run these two commands at the start of my session:

Import-Module ActiveDirectory

Import-Module GroupPolicy

I still have my little test domain called, corp.Contoso.com, with a child domain of HQ.corp.Contoso.com. And I can very easily use the Get-GPO cmdlet with the –all parameter to see all the GPOs in the entire forest with the following command:

(get-ADForest).domains | foreach { get-GPO -all -Domain $_ }

This will display all the GPO information, but it will come as the GPOs are read from each domain.

Now, it becomes clear why I started this blog mentioning Jeffrey Snover’s blog post about sorting a table using the –GroupBy parameter. I want to see all the GPO information grouped by the status of each GPO. What happens if I add Format-Table (with alias of ft) using the –GroupBy parameter to the end of my previous command line?

(get-ADForest).domains | foreach { get-GPO -all -Domain $_ } | Format-Table -GroupBy GpoStatus

This will group the GPOs, but not quite as I expected. Instead of one table for AllSettingsEnabled, another for AllSettingsDisabled, etc., I seem to be getting clumps of GPOs based on status. You can see that in this partial display.

There’s a technical reason that Jeffrey goes into in his blog post. But the short answer is that the Format-Table cmdlet processes the input as it comes to the cmdlet. There’s no place to hold the input in order to group all of the results together at once. Presorting the information in this case will get us what we really want.

I want to make sure the GPO status is sorted first. Then it’s a toss-up of whether I want to see GPOs in alphabetical order based on the display name or an alphabetized list of GPOs first grouped by domain. For this example, I’m going to list the GPOs in alphabetical order within the GPO status groups. I’ll leave it up to you to play with changing the order of the sort to see what happens.

(get-ADForest).domains | foreach { get-GPO -all -Domain $_ } | sort GpoStatus, DisplayName | Format-Table -GroupBy GpoStatus

Now, we get what we wanted a series of tables that show GPOS based on status: AllSettingsDisabled, UserSettingsDisabled, ComputerSettingsDisabled, and AllSettingsEnabled. Much better.

My only problem with this is I can’t see all the data because my screen isn’t wide enough. The other way of displaying all the data for GPOs worked better in this case. So, how can I group by GpoStatus, and get all my data?

The answer is once again pretty simple. The –GroupBy parameter also works for Format-List.

Running the following command gives me the results I want:

(get-ADForest).domains | foreach { get-GPO -all -Domain $_ } | sort GpoStatus, DisplayName | Format-List -GroupBy GpoStatus

You can try grouping by other things than GpoStatus. For example, you can DomainName, Owner, or WmiFilter. Or try sorting by CreationTime or ModificationTime.

Group Policy in Windows Server 2012: Infrastructure Status

GPTeam — Thu, 29 Nov 2012 17:03:00 GMT

You may be asking yourself, “What does infrastructure status have to do with Group Policy”. Well, group policy depends on other technologies to ensure that policy settings are replicated throughout your environment so that end users / computers will get the settings that you configure.

And when you’ve run into problems you start wondering: did replication finish? Are there errors? And if there are, how am I supposed to see what errors have happened?

Since you are a GP admin and not necessarily an AD/DFSR admin, you only want to know that all of the replication that is supposed to be happening for Group Policy Objects is happening. In Windows Server 2012 we have added a feature that will tell you just this.

The feature is called Infrastructure Status and you can find it in the GPMC results pane for each domain object. Simply click the domain that you are interested in and in the result pane you will see a new tab labeled “Status”. This “status” tab will show the status of GPO replication (for both SYSVOL and AD) of all GPOs across your entire domain.

If you suspect you have a replication problem with a single GPO, to speed up your troubleshooting, you can check the infrastructure health status for that GPO. To see the status, open the Group Policy Objects node and select the GPO listed under that node.

Note: The infrastructure health status is not available when you click on GPO links displayed under the domain and OU nodes.

Initially, the Status tab will not have any information about replication status. Once you hit “detect now”, the GPMC contacts all domain controllers in your domain and collects information about Group Policy Object(s) from AD and SYSVOL. It uses a “baseline” domain controller to compare GPO information against GPO information from all other domain controllers. The baseline domain controller defaults to the DC that the GPMC is connected to but can be changed by clicking Change.

The first level of information will show the number of domain controllers that have GPO information “In Synch” with the baseline domain controller and the number of domain controllers that have GPO information that is “In Progress”. Domain controllers that are “In Synch” have all of the same GPO information as the baseline DC. Domain controllers that are “In Progress” do not have all of the same GPO information as the baseline DC. This may mean that there is a problem with GPO replication but it also may mean that replication just has not converged yet. For those DCs that are “In Progress” additional details are provided which explain exactly what is not in sync. The following is the list of reasons a DC can be “In Progress”:

Active Directory
	Accessibility	If the Active Directory service cannot be contacted on a domain controller, this message will be displayed.
	GPO Version	If the GPO version information in AD is different than the baseline domain controller, this message will be displayed and details about the GPOs that are different can be seen by clicking the message.
	Number of GPOs	If the total number of GPOs in AD is different than the baseline domain controller, this message will be displayed and details about the number of GPOs that are different can be seen by clicking the message.
	Created Date	If the created date stored in AD for any GPO is different than the baseline domain controller, this message will be displayed and details about the GPOs with different dates from the baseline DC can be seen by clicking the message.
	Modified Date	If the modified date stored in AD for any GPO is different than the baseline domain controller, this message will be displayed and details about the GPOs with different dates can be seen by clicking the message.
	ACLs	If the Active Directory permissions on any GPO are different than the baseline domain controller, this message will be displayed and details about the GPOs with different permissions can be seen by clicking the message.
File System (SYSVOL)
	Accessibility	If the SYSVOL folder cannot be contacted on a domain controller, this message will be displayed.
	GPO Version	If the GPO version information in the GPT.ini file is different than the baseline domain controller, this message will be displayed and details about the GPOs that are different can be seen by clicking the message.
	Number of GPOs	If the total number of GPOs in SYSVOL is different than the baseline domain controller, this message will be displayed and details about the number of GPOs that are different can be seen by clicking the message.
	GPO Contents	If the content of SYSVOL for any GPO is different than the baseline domain controller, this message will be displayed and details about the GPOs with inconsistent contents can be seen by clicking the message. The content comparison is performed by creating a file hash for all files within each GPO folder on SYSVOL. The hash from the baseline DC is compared to the hash from each DC.
	ACLs	If the SYSVOL permissions on any GPO are different than the baseline domain controller, this message will be displayed and details about the GPOs with different permissions can be seen by clicking the message.

Within the details of each of the errors a link is provided to help you further investigate why the DC is not In Sync.

Group Policy can be very difficult to troubleshoot and we hope that this feature allows you to find and resolve GP related replication issues more quickly.

Group Policy in Windows Server 2012: Results Report Improvements

GPTeam — Wed, 28 Nov 2012 17:02:00 GMT

Another change we made in Windows Server 2012 is in the Resultant Set of Policy reports. In previous versions of Server, you had to look at the results report, and the event log, and the tracing logs to find all the information you needed about why policy did or did not apply. Now, we’ve consolidated most of that information right into the results report to make troubleshooting Group Policy easier.

The biggest change we made is to the Summary section.

Here’s what the summary section used to look like:

And here’s what it looks like now:

As you can see, we summarized important information that was previously difficult to find, like loopback mode, slow link detection, and GPOs with enforce (or have block inheritance enabled)

We also added information to the computer/user details. Now we show how long client side extensions take to process, the last time an extension processed and detailed event log information from the latest pass of policy.

We also added more detail to the report, including sorting information by GPO, showing where the GPOs were linked, and reporting on modifiers like “enforced” or “disabled”.

How you run the GP results report hasn’t changed. If you choose to run it from the GPMC against a remote client, the client needs the following firewall ports opened:

· Remote Event Log Management (NP-In)

· Remote Event Log Management (RPC)

· Remote Event Log Management (RPC_EPMAP)

· Windows Management Instrumentation (WMI-In)

Running it this way against a downlevel client still gets you the new format and most of the new information.

The command line GP results functionality still works. You can run gpresult.exe /h out.html on a client machine to have the report created as out.html. However, this will only get you the new format and information when it’s run on a Windows “8” machine.

Group Policy in Windows Server 2012: Using Remote GPUpdate

GPTeam — Tue, 27 Nov 2012 17:01:00 GMT

Group Policy in Windows Server 2012: Using Remote GPUpdate

If someone calls to say their computer doesn’t work quite right, the first thing you might have them do is run gpupdate /force to ensure they have the latest policy applied to their system. Now, you have the power to reach out and force a gpupdate without needing to be at the computer, remote in, or ask the user do it themselves.

The way remote gpupdate works is this: It creates a task through task scheduler. The task will execute within the next 10 minutes, which runs the GPUpdate locally on the machine. This will work on Vista and beyond.

Because this feature uses a remote connection, in order to use it you will need the following firewall rules enabled on clients.

· Remote Scheduled Tasks Management (RPC)

· Remote Scheduled Tasks Management (RPC-EPMAP)

· Windows Management Instrumentation (WMI-In)

Once you have these firewall rules applied to your clients, there are two ways you can invoke a remote Group Policy update.

Remote GP Update Wizard

From the GPMC, right click on an OU that contains computer objects.

Click the “Group Policy Update” option.

This will run a gpupdate /force on all computers in the OU, and any subOUs. Computer policy will be refreshed for each computer, and user policy will be refreshed for any and all users currently logged into those computers.

The “success” and “failure” headers indicate how many computers were contacted and had the event planted on the computer. It does not indicate that those computers have already run gpupdate – just that they have successfully scheduled the update for some time in the next 10 minutes. In this case, I intentionally sabotaged one of my clients to demonstrate what failure looks like – you see an error code and a description, and you can “Save” your results to a .csv file to review what computers succeeded and did not succeed in receiving the task.

Powershell

The other option is to use Group Policy’s new PowerShell cmdlets. The Invoke-gpupdate cmdlet is part of the Group Policy Powershell Module that is installed when you install the Group Policy Management Feature on a machine.

This cmdlet gives you more flexibility with how Group Policy is updated. You can use all of the gpupdate parameters you may be familiar with, plus you can use the new remote GP update functionality to target one computer – or write a script that targets many computers.

An example of the most basic use of invoke-gpupdate:

Import-module groupPolicy

Invoke-gpupdate computername

The completion of this cmdlet will put a task on the computer that will execute a gpupdate /force

Group Policy in Windows Server 2012: Overview

GPTeam — Mon, 26 Nov 2012 17:00:00 GMT

Now that Windows 8 and Windows Server 2012 have been released, we’d like to share with you some of the exciting enhancements that we’ve added for Group Policy.

While we hear plenty of great things from people who use Group Policy, we also hear complaints. By far the largest complaint we hear about Group Policy has to do with troubleshooting GP. Our main goal for Server 2012 was to improve the troubleshooting experience.

We added 3 new features to make your life as a GP admin easier. In the next week we’ll detail each of these improvements in their own blog post, but for now here’s a quick overview.

· Remote GP Update: Allow you to remotely update policy on one client computer or an entire OU, through the GPMC or through Powershell

· GP Results Report improvements: We’ve changed the layout and added a bunch of new information to the results report, including relevant events, specific callouts for disabled user/computer sections, extension processing time, and more!

· Infrastructure Status: We’ve made it easy to check in on replication status to make sure GPOs are propagating properly.

If you just can’t wait to learn more, there’s additional documentation of new features here: http://technet.microsoft.com/en-us/library/hh831791.aspx

Group Policy Settings Reference Spreadsheet

GPTeam — Tue, 25 Sep 2012 00:08:50 GMT

The Group Policy settings reference spreadsheet that covers
the available administrative template settings and security settings for
Windows Server 2012, Windows 8, and all earlier versions of Windows is now
available in the download center here: http://go.microsoft.com/fwlink/?LinkId=261775.

New to This Spreadsheet

The Administrative Template spreadsheet contains a new column:

Status: A "New" in this column means
that the setting did not exist prior to Windows Server 2012 and Windows 8. It
does not mean that the setting applies only to Windows Server 2012 and Windows
8. Refer to the column entitled "supported on" to determine to which
operating system the policy setting applies.

To see the full description of what is contained in this
latest version before downloading, go here: http://www.microsoft.com/download/en/details.aspx?id=25250

Windows Server “8” Settings Spreadsheet

GPTeam — Mon, 16 Apr 2012 16:50:38 GMT

The latest Group Policy settings reference spreadsheet that covers the available administrative template settings and security settings for Windows Server “8” Beta, Windows 8 Consumer Preview and all earlier versions of Windows is now available in the download center here: http://download.microsoft.com/download/8/F/B/8FBD2E85-8852-45EC-8465-92756EBD9365/WindowsServer8BetaandWindows8ConsumerPreviewGroupPolicySettings.xlsx

To see the description of what is contained in this latest version before downloading, go here: http://www.microsoft.com/download/en/details.aspx?id=25250

How to add comment for a GPO with PowerShell

GPTeam — Wed, 13 Jul 2011 23:26:57 GMT

You might have seen GP MVP Jeremy Moskowitz’s post on how to recycle GPO comments. While Jeremy points out you can do this without a script…. You can also do it with a script! Our tech writer, Judith, walks us through the process:

After I import the Group Policy module in PowerShell, I have access to the Get-GPO cmdlet. If I run that to create an object representing my test GPO:

PS C:\ > $testGPO = Get-GPO testGPO

PS C:\ > $testGPO

DisplayName : testGPO

DomainName : corp.contoso.com

Owner : CORP3\Domain Admins

Id : 4364e8c5-23a0-4020-9624-4dbcaac9c8c2

GpoStatus : AllSettingsEnabled

Description :

CreationTime : 5/9/2011 10:07:09 AM

ModificationTime : 6/27/2011 3:51:20 PM

UserVersion : AD Version: 1, SysVol Version: 1

ComputerVersion : AD Version: 1, SysVol Version: 1

WmiFilter :

I was pretty sure that Description would show the comment for the GPO. And I ran the Get-Member cmdlet against the $testGPO object just to verify that I can use the Description property to set the comment using PowerShell.

PS C:\ > $testGPO | gm -Membertype property

    TypeName: Microsoft.GroupPolicy.Gpo

    Name MemberType Definition

    ---- ---------- ----------

    Computer Property Microsoft.GroupPolicy.ComputerConfiguration Computer {get;}

    CreationTime Property System.DateTime CreationTime {get;}

    Description Property System.String Description {get;set;}

    DisplayName Property System.String DisplayName {get;set;}

    DomainName Property System.String DomainName {get;}

    GpoStatus Property Microsoft.GroupPolicy.GpoStatus GpoStatus {get;set;}

    Id Property System.Guid Id {get;}

    ModificationTime Property System.DateTime ModificationTime {get;}

    Owner Property System.String Owner {get;}

    Path Property System.String Path {get;}

    User Property Microsoft.GroupPolicy.UserConfiguration User {get;}

    WmiFilter Property Microsoft.GroupPolicy.WmiFilter WmiFilter {get;set;}

Then I changed the comment by setting $testGPO.Description to a string value, which just looks like a simple assignment:

PS C:\ > $testGPO.description="This is my test GPO. I'm using this to try out GP and PowerShell."

PS C:\ > $testGPO

    DisplayName : testGPO

    DomainName : corp.contoso.com

    Owner : CORP3\Domain Admins

    Id : 4364e8c5-23a0-4020-9624-4dbcaac9c8c2

    GpoStatus : AllSettingsEnabled

    Description : This is my test GPO. I'm using this to try out GP and PowerShell.

    CreationTime : 5/9/2011 10:07:09 AM

    ModificationTime : 6/27/2011 3:51:20 PM

    UserVersion : AD Version: 1, SysVol Version: 1

    ComputerVersion : AD Version: 1, SysVol Version: 1

    WmiFilter :

Here’s the GPMC snapshot before changing the comment:

And here’s the GPMC snapshot after I changed the comment:

Listing all GPOs in the current forest

GPTeam — Fri, 10 Jun 2011 20:53:53 GMT

This post was written by Judith, a technical writer for Group Policy. This is the second post in a series on ways to use Powershell with Group Policy. See the first post on getting started with RSAT and Group Policy

Let’s say I have a forest and I’d like to document a listing of all the GPOs in that forest. And maybe be able to list the GPOs mapped to the domain the GPO is created in.

I can start with the Get-ADForest cmdlet which creates an object for the forest I’m logged into. This object has a Domains property. How do I know this? I can find this out by running:



Get-ADForest | Get-Member

Once I know that I can get a list of all the domains in the forest using the Domains property, I can pipe those domain names into the Get-GPO cmdlet to find the names of all GPOs for each domain in the forest.

Here’s how it works out in one long line:

(get-ADForest).domains | foreach { get-GPO -all -Domain $_ | Select-Object @{n='Domain Name';e={$_.DomainName}}, @{n='GPO Name';e={$_.DisplayName}} }

The Select-Object cmdlet is used to create an associative array that maps the domain name with the GPO name.

For a sample domain called corp.Contoso.com, with a child domain of HQ.corp.Contoso.com, with one test GPO named testGPO, I would get a listing that looks like this:

Domain Name         GPO Name

-----------         --------

corp.contoso.com     Default Domain Policy

corp.contoso.com     testGPO

corp.contoso.com     Default Domain Controllers Policy

HQ.corp.contoso.com Default Domain Policy

HQ.corp.contoso.com Default Domain Controllers Policy

Pipe the output of this command to the Out-Gridview cmdlet to get a spreadsheet style listing of GPOs for each domain in the forest.

(get-ADForest).domains | foreach { get-GPO -all -Domain $_ | Select-Object @{n='Domain Name';e={$_.DomainName}}, @{n='GPO Name';e={$_.DisplayName}} } | Out-Gridview

RSAT & GP Cmdlets

GPTeam — Thu, 09 Jun 2011 22:06:13 GMT

This post was written by Judith, a technical writer for Group Policy. This will be the first post in a series on ways to use Powershell with Group Policy

I wanted to play around with the Group Policy cmdlets. These are installed on Windows Server 2008 R2 automatically when Group Policy is installed. But what I really wanted to do was use them on my Windows 7 client machine where I do most of my Group Policy administration.

I installed RSAT (Remote Server Administration Tools) for Windows 7, I now had access to the Group Policy cmdlets on my Windows 7 client.

So, instead of having to remote into my Windows Server 2008 R2 server directly or try to use the remoting built into Windows PowerShell, I can install RSAT and then use the GP cmdlets in the same way I would on Server 2008 R2.

Once RSAT is installed, I can open a Windows PowerShell command window and find out the Windows PowerShell modules that I can use with the command get-module -listavailable

    PS C:\> get-module -listavailable

    ModuleType     Name                 ExportedCommands

    ----------     ----                 ----------------

    Manifest     ActiveDirectory     {}

    Manifest     AppLocker             {}

    Manifest     BitsTransfer         {}

    Manifest     GroupPolicy         {}

    Manifest     PSDiagnostics         {}

    Manifest     TroubleshootingPack {}

Then I can import the Group Policy module to make all the GP cmdlets available within my Windows PowerShell window with the command import-module GroupPolicy

And a scripting we will go…

Get GPO Backup with Powershell

GPTeam — Tue, 24 May 2011 21:11:51 GMT

Jeff Hicks, one of Microsoft’s Powershell MVPs, has written a great script for managing GPO backups:

The GroupPolicy module from Microsoft offers a great deal of functionality from a command line. In terms of regular maintenance or administration it is pretty hard to beat, especially if you have 100s or 1000s of GPOs. When you have such a large number, backing them up is critical and easy to accomplish with the Backup-GPO cmdlet. However, if you want to restore or import from a backup, you have to resort to the graphical Group Policy Managment Console. I couldn’t find any way to manage GPO backups from PowerShell so I wrote my own.

It also has explanations for how the script functions, and how to use it. The download link is at the bottom of his post.

Copy and Merge GPOs through Powershell

GPTeam — Wed, 19 Jan 2011 20:01:36 GMT

Ashley McGlone has a great script up for merging GPOs together through powershell.

I wish I had this script five years ago. At the time I was searching for a way to combine or merge GPOs, but there simply wasn’t a way to do it. And today there still isn’t a way to do it… until POWERSHELL! Almost every environment I see (including my own former environment) has a collection of GPOs that have evolved over time and really need to be consolidated and cleaned up.

In Windows Server 2008 R2 we released a new PowerShell module for Group Policy administration. I haven’t seen much written about it, and I don’t think many people realize it is there.

Check it out!

AGPM Least Privilege for Child Domain

GPTeam — Fri, 22 Oct 2010 19:00:41 GMT

Michael has covered “least privilege” for AGPM before (the Active Directory team followed up with a bit more detail). However, those scenarios are for single-domains. What if you have a forest where you want to manage all the child domains using AGPM, but you don’t want to just give the AGPM service administrator privileges across your entire forest? This guide will show you how to let the AGPM functionality take root with the minimum amount of privilege for each child in your domain.

For this example we’re using CONTOSO.COM as our root DC. CHILD.CONTOSO.COM is the child domain in the forest. Our AGPM server is in CONTOSO.COM running under the user “AGPMService”. (Side note: Wondering why “Contoso”?)

There are three permissions AGPM requires to run in a child domain.

1) Give AGPMService permission in the GPO directory. This will allow AGPM to check policies in and out.

a. Open GPMC.MSC for the child domain.

b. Click on the “Group Policy Objects” container.

c. In the “Delegation” tab, click “Add…” and add AGPMService from the parent domain.

2) Give AGPMService permission for any existing GPOs. This will allow AGPM to take control of any existing GPOs.

a. For each GPO that already exists in the child domain (In our example, that would be the 2 GPOs starting with “Default Domain…”), select it in the GPMC

b. Select the “Delegation” tab, click “Add…”, and add the AGPMService from the parent domain

3) Add AGPM to the “Backup Operators” builtin security group.

a. Open “Active Directory Users and Computers” for the child domain.

b. Navigate to the builtin container and right-click on Backup Operators.

c. Select “Properties”, then navigate to “Members” and click “Add…”, and add the AGPMService from the parent domain.

You should now be able to use AGPM in the child domain.

Tales from the Community - Deleting a registry value

GPTeam — Fri, 01 Oct 2010 19:39:56 GMT

Tales from the Community – Deleting registry values

Okay, I've seen this question in the Technet Forums that basically goes like this:

"Hey I have this reg script that deletes a value off the registry for me. The .reg file does

[HKEY_CLASSES_ROOT\.ext\someApplication\ShellNew]

"FileName"=-

- can I do that with an ADM template? All I have is

CLASS MACHINE

CATEGORY "Software\CLASSES\.ext\someApplication\ShellNew"
KEYNAME "Software\CLASSES\.ext\someApplication\ShellNew"

POLICY "FileName"
PART "FileName"
NUMERIC
VALUENAME "FileName"
END PART
END POLICY

END CATEGORY

but that doesn't work!"

Okay, so let's disassemble this. From the .REG file output, the poster already figured out correctly, that HKEY_CLASSES_ROOT is a substitution for HKLM\SOFTWARE\CLASSES or HKCU\SOFTWARE\CLASSES depending on whether you want the setting stick for users or all users on a machine. Obviously the poster decided to use that as a machine setting, hence CLASS MACHINE.

Unfortunately, the NUMERIC PART isn't capable of deleting keys (at least not that I knew), so we need so tricking here to get the key deleted. Using a CHECKBOX PART leaves us the opportunity to use a VALUEON/VALUEOFF pair in our ADM template - and VALUEON/VALUEOFF know the "DELETE" keyword -- off we go:

CLASS MACHINE

CATEGORY "Florians testing"

KEYNAME "Software\FlorianTesting"

POLICY "FileName"

PART "FileName" CHECKBOX

VALUENAME "myTest"

VALUEON DELETE

VALUEOFF 2

END PART

END POLICY

END CATEGORY

So that totally worked for me. The GP setting would display a checkbox when "enabled". If that checkbox is checked, it would delete the value off the registry. If it's unchecked upon closing and saving the setting, it would set the value to 2. That's it. That's all the magic. Worked for me like a charm.

That just leave a couple of questions open... why the heck all the hassle with ADM(X)? Seriously, if you've already got hands on a working .REG file, why not deploy it in a computer startup script use regedit /s myFile.reg and forget about the ADM(X) template pain? Better yet, why not use GP Preferences to push the registry deletion to the clients? Since it's *this* cool, I thought I'd paste a screenshot to guide you there:

I must admit I've been a fan of ADM template. They were just kind of geeky and they were kind of a language you could show your friends you understood. But hey, we're in 2010 now. Let's move on :-)

Cheers,

Florian (Group Policy MVP)

More on searching group policy

GPTeam — Tue, 14 Sep 2010 18:32:00 GMT

Here’s a quick follow-up to our last post on the existence of GPO search. One of our MVPs, Alan, has a great post up about a Group Policy Search webapp (Previously mentioned on this blog). It includes instructions on how to install a Windows Search connector – so you can use this search right from Windows Explorer!

Someone noted that you can't search for comments in the GPMC search. Very true! However, by using the "Description" property exposed by Group Policy cmdlets in Powershell, we might be able to make something work…

This script searches for policies with comments and displays them:

import-module grouppolicy; #use group policy cmdlet

$arrPolicy = get-gpo –all; #get all GPOs and store them in an array

$arrCommented = @(); #create an empty array for GPOs matching our criteria (in this case, commented GPOs)

Foreach($GPO in $arrPolicy) {

If ($GPO.Description) { $arrCommented += $GPO; } #if it has a comment, add it to the array

}

Write-output (format-list –property DisplayName, Description –inputobject $arrCommented); #Make it look pretty and then print it

This script searches for policies with comments and displays them. In Powershell, you can test for the existence of a property with if($property) and the non-existence of a property if(!$property) . (These statements can also be understood as:

if ($property -eq $NULL) and if($property –ne $NULL)

respectively. Just one of the many shortcuts Powershell provides!)

Once you have this up and running, you can try a few other things. Want to search for a specific substring within the comments? Replace the if-statement above with these two lines:

If ($GPO.Description)

{ if ( $GPO.Description.contains(“foo”) ) {$arrCommented += $GPO; } }

The first if-statement is still checking for existence, so the second if-statement can be assured the description exists – and look through it for any specific string.

Of course, this script probably could be reduced down to a few lines. If anyone wants to go golfing with this script, post your best entry in the comments!

Group Policy Videos

GPTeam — Fri, 03 Sep 2010 17:07:02 GMT

We've got two new videos for you!

The TechNet guys dropped by to ask Lilia some questions (always a good idea, in my opinion), and in return she dropped some knowledge.

http://edge.technet.com/Media/Group-Policy-Search-with-Lilia/ - Did you know about the search dialogue box in the Group Policy Management Console?!

http://edge.technet.com/Media/troubleshooting-using-gplogview/ - Using GPLogView to troubleshoot. A great companion to our previous blog post.

There's a ton of great information in these videos. I hope you enjoy them!

More powershell & group policy

GPTeam — Tue, 27 Jul 2010 22:57:37 GMT

I do not know about you but I LOVE PowerShell, especially the Group Policy cmdlets. Unfortunately, I didn’t have too many opportunities to really use them - but luckily got a chance in preparation for a presentation where I would demo a script that Lindsay (from our dev team) put together.

This script allows you to find any Group Policy setting across all of your GPOs in your domain. Lindsay outlines how to use her script in the following blog posts:

Video on TechnetEdge: Searching for settings in a GPO

Checking a setting in all GPO’s (Security ADMX, and more)

Checking a setting in all GPO’s continued (scripts, firewall, GP Preferences and more)

In preparing, however, I encountered something that many of you have already run into: The suspicious lack of a get cmdlet for GPlinks. Executing the get-help *-GPLink* command in a PowerShell window with the GP cmdlets loaded returns the following:

Name                                                    Category                              Synopsis
--------                                                   ------------                            ------------
New-GPLink                                       Cmdlet                                 Links a GPO to a site, domain, o…
Remove-GPLink                                  Cmdlet                                 Removes a GPO link from a site, …
Set-GPLink                                          Cmdlet                                 Sets the properties of the speci…

Where is the Get-GPLink? It does not exist. Well at least it is not included as one of Microsoft’s cmdlets. I have found that a PowerShell function was created by Jeff Hicks in an attempt to fill the void. For my demo, however, I wanted a built-in solution.

After some digging and experimenting, I found a simple way to determine what containers a GPO is linked to and it can be done with only 3 lines of PowerShell script. I used the Active Directory get-ADObject cmdlet combined with the Filter parameter. The filter parameter allows me to use PowerShell Expression language to query AD for the object that I am looking for. The specific thing that I am looking for is any object that has the gPLink property which contains the GUID for the GPO I am interested in.

To do that I first need to get the GUID for the GPO I am interested in:

1. $myGPO = Get-GPO –name {display name of GPO}

2. $myGPOID = “*” + $myGPO.Id + “*”

Then I pass that into the get-ADObject cmdlet to get the FQDNs for all containers that the GPO is attached to:

3. $Path = get-ADObject –Filter {gPLink –Like $myGPOID}

And as simple as that, I have all containers stored in the variable $Path that a specific GPO is linked to.

MarkG

Group Policy & Scripting

GPTeam — Fri, 23 Jul 2010 19:31:57 GMT

Hey, Scripting Guy! has a great series of posts around Group Policy & scripting:

Using group policy cmdlets for backup and restore

Test AD replication with group policy cmdlets

How to compare 2 GPOs offline (Part II)

Cross post: AskDS Group Policy Search Settings in the cloud

GPTeam — Mon, 28 Jun 2010 20:25:00 GMT

Kapil posted a great article about a new tool created by Stephanus Schulte and Jean-Pierre Regente. It's an Azure-hosted tool that keyword searches Group Policy settings. Read about it here: http://blogs.technet.com/b/askds/archive/2010/06/24/announcing-the-group-policy-search-service.aspx

Check it out here: http://gps.cloudapp.net/

Here's what it looks like in action:

Go forth and discover!

@superlilia

How long does this script / WMI Filter take?

GPTeam — Fri, 25 Jun 2010 16:17:00 GMT

I was reading GP MVP Darren Mar-Elia’s forum about WMI Filters and discovered a sweet PowerShell trick from another awesome friend of the GP team, Thorbjörn Sjövold (CTO of Specops Software)

You can use the PowerShell cmdlet “measure-command” to measure the time it takes to run script blocks and cmdlets – this includes WMI filters! This came up in a thread about logon time.

Read the full thread here.

Here's how to set it up"...deploy a new environment variable, for example INSTALLADOBE using Group Policy Preferences. Use their Windows Installer Target and then use a WMI filter like this for the actual installation.

SELECT * FROM Win32_Environment WHERE Name = 'INSTALLADOBE'

You can compare the two WMI queries like this using PowerShell to get an idea on how much faster it is:

measure-Command {Get-WmiObject -query "SELECT * FROM Win32_Environment WHERE Name = 'OS'"}

just substitute the OS name with the name of any Environment variable like INSTALLADOBE, but to test the speed it does not really matter.

measure-command {Get-WmiObject -query "Select * from Win32_Product where Name like '%Adobe Reader%'"}

Thanks guys! Hope you find this useful,

@superlilia

Re-post: Darren Mar-Elia's "Controlling Shares on Windows Systems"

GPTeam — Wed, 23 Jun 2010 06:02:44 GMT

Darren Mar-Elia, aka GPOGuy, wrote a cool post about using Group Policy Preferences to remove unwanted network shares from your environment. Group Policy Preferences can do everything! If you've got Windows Server 2008 or above, you've already got GP Preferences at your disposal.

Read on : http://sdmsoftware.com/blog/2010/06/22/controlling-shares-on-windows-systems/

To get more detail on what you need to use Group Policy Preferences, read here:

http://blogs.technet.com/b/grouppolicy/archive/2009/03/27/group-policy-preferences-not-applying-on-some-clients-client-side-extension-xmllite.aspx

hope this helps,

@superlilia

Importing and Exporting with AGPM

GPTeam — Fri, 11 Jun 2010 20:59:27 GMT

Thanks for tuning in this lovely Friday! Time for a glimpse into the advanced side of Group Policy, with Advanced Group Policy Management. This awesome product comes as part of MDOP (Microsoft Desktop Optimization Pack), which you can get easily if you have SA. Read more about it here on TechNet. The following article on how to migrate between Controlled and Uncontrolled GPO’s is by Deepak Vishwanathan, a hardworking developer on the Group Policy team.

- superLilia

Now, say your enterprise is using AGPM and has a mixed environment of controlled and uncontrolled GPOs. Let’s say you want to export the settings from your controlled GPO “Sales” and import them into an uncontrolled GPO “Mobile Sales”.

You try, but you fail. Why?

To import settings, the GPMC (Group Policy Management Console) is expecting a GPMC backup. But the AGPM export output is not a GPMC backup.The output of AGPM export operation is a cabinet file, whereas the output of GPMC backup operation is a GPO backup directory tree. So, we need a mechanism to convert the AGPM cabinet file into a GPO backup directory tree, so it can be imported by the GPMC.

The same problem happens in the reverse: if you want to import settings of an uncontrolled GPO into an AGPM-controlled GPO. The input to the AGPM import operation is a cabinet file, whereas the output of GPMC backup operation is a GPO backup directory tree. Again, we need to convert from GPO backup directory tree to AGPM import cabinet file.

No problem!!! Welcome Microsoft Cabinet SDK :) The Microsoft Cabinet SDK is publicly available for download at http://support.microsoft.com/kb/310618. This SDK contains compression / decompression utilities that help to work with cabinet files. In order to accomplish our task, Cabarc utility will come handy. To read more about Cabarc utility, refer to http://technet.microsoft.com/en-us/library/cc781787(WS.10).aspx

So, let’s consider the following 2 generic scenarios:

1. Import controlled GPO to uncontrolled environment

(1) Export a controlled GPO using AGPM export operation.

The output of export operation is a cabinet file containing the compressed GPO backup.

(2) Decompress the exported cabinet file using Cabarc utility.

Let’s say the exported GPO’s cabinet file path is d:\controlledGPObackups\controlled.cab.

Let’s make the backup directory for uncontrolled GPOs d:\uncontrolledGPObackups and we want to use that directory as the target directory for the decompression command.

Run this command:

Cabarc.exe -p X d:\controlledGPObackups\controlled.cab d:\uncontrolledGPObackups\

Note:

· X is the command for decompressing a cabinet file.

· The back slash trailing the target directory is mandatory.

· While decompressing, we need to ensure that the filepaths for the compressed files are retained. To ensure this, we use the –p (path preserve) option.

Once the command is executed, the decompressed GPO Backup root directory would be d:\uncontrolledGPObackups\{3D92F8A6-21DD-4BF9-B153-0CD5FF5539C9} (assuming, {3D92F8A6-21DD-4BF9-B153-0CD5FF5539C9} is the exported GPO’s backupId).

(3) Import the decompressed GPO backup into uncontrolled GPO using GPMC import utility.

2. Import uncontrolled GPO to controlled environment

(1) Backup the selected uncontrolled GPO using GPMC backup utility.

(2) Create an AGPM import compliant cabinet file using cabarc utility.

Let us consider that the uncontrolled GPO’s backup directory path is d:\uncontrolledGPObackups\{3D92F8A6-21DD-4BF9-B153-0CD5FF5539C9}.

Use the following command to generate the cabinet file d:\compressedGPOs\uncontrolledGPO.cab.

Cabarc.exe -P uncontrolledGPObackups\ -p -r N d:\compressedGPOs\uncontrolledGPO.cab d:\uncontrolledGPObackups\{3D92F8A6-21DD-4BF9-B153-0CD5FF5539C9}\*

NOTE:

· N is the command for creating new cabinet file.

· Since we need to retain only {3D92F8A6-21DD-4BF9-B153-0CD5FF5539C9} portion of the filepaths for the files that need to be added to the cabinet file, we use the –P (Path stripping) option.

· We also need to use –p (path preserve) option, so that the added files have file names starting with {3D92F8A6-21DD-4BF9-B153-0CD5FF5539C9}.

· We also need to use –r (recurse into subdirectories while adding files) option.

(3) Check out the controlled GPO using AGPM checkout operation, if the GPO is not already checked out.

(4) Import the cabinet file into the existing checked out GPO using the AGPM import operation.

The moral of the story? Control all of your GPO’s if you are using AGPM! Even if you don’t, there are ways to work with controlled and uncontrolled GPOs.

Hope this helps!

Deepak

Scripts I Mentioned

GPTeam — Tue, 20 Apr 2010 20:39:00 GMT

Hey everyone at MMS (or TechReady, or anywhere for that matter)

If you've followed my advice and you're checking the blog, here's a neat little present for you!

Did someone make 1000 GPO's with the word 'test' in them just to test out some sweet new PowerShell script? Do you want to punch them in the face for bloating your environment?

No need! Do what I did, make a list of all of the GPO's with 'test' in the name ('contains' is case sensitive, so be mindful of that).

$listTest = get-gpo -all | where {$_.DisplayName.contains("test")}

foreach ($GPO in $listTest) {remove-GPO $GPO.DisplayName}

Done!

Here are the scripts I've mentioned in today's presentation:

Search for any setting using the XML report:

http://blogs.technet.com/grouppolicy/archive/2009/04/14/tool-images.aspx

Backup all changed GPO's in the last month:

http://blogs.technet.com/grouppolicy/archive/2009/03/26/powershell-script-backup-all-gpos-that-have-been-modified-this-month.aspx

Enjoy!

your friendly @superlilia

WMI Filter Friday

GPTeam — Fri, 19 Mar 2010 22:53:00 GMT

It’s Friday and it’s sunny in my neighborhood, which means it is blog posting time! Let’s talk about WMI filters today, shall we?

If I have WMI Filters and Group Policy Preferences targeting, do they cancel out? Does one have precedence? Will the world explode?

My answers are: No, Yes, and Maybe someday (but that’s more a Stephen Hawking conversation than a @superlilia blog post).

WMI Filters apply to the GPO as a whole; GP Preferences targeting is per Preferences item. That is, per drive mapping, per shortcut, per printer, per power plan.

Scene:

Edit a GPO, create multiple Preferences items and target each of them differently. Let’s say, you’re targeting Power Plans; you want the Power Plans to be applied only if it’s business hours (Monday-Friday from 9am-5pm).

All of those items are in one GPO with a WMI filter – this will evaluate whether or not the GPO should be applied to the computer it is being pushed out to. For example, only for XP machines.

The order will be evaluate WMI filter first, then GP Preferences targeting. If the WMI filter says this GPO won’t be applied to the computer, then the Preferences items won’t even be evaluated. Get it? They’re inside the GPO, if the GPO doesn’t apply to that computer, it doesn’t matter what’s inside.

GP Preferences targeting can evaluate much more than just computer attributes: date/time, local security group membership, language, and 25 other filtering options.

Example WMI filters:

Operating system: Only target computers running Windows XP Professional.

Root\CimV2; Select * from Win32_OperatingSystem where Caption = "Microsoft Windows XP Professional"

Example GP Preference target:

You could apply the Preferences targeting to one of your Power Plans within a GPO, and the WMI Filter to the GPO as a whole. Then, if the computer is running XP, the WMI filter will pass and the Preferences targeting will be evaluated for this item only. If it’s Monday through Friday between 9am and 5pm, the Preferences item will be applied.

Read more about WMI Filters here on Technet.

Read more about GP Preferences targeting here on Technet, or here , here, and here on this blog.

Final note: where there’s overlap, I always suggest using Preferences targeting. It’s more granular, the reporting is much easier, and it runs faster than WMI filters. For more on WMI filter speed, read here.

Hope this helps,

LiliaG, Group Policy PM

@superlilia