Archive for 'GPMC'

Changes to GroupPolicy RSOP in Windows 8

Posted by:

Changes to GroupPolicy RSOP in Windows 8

While much is changing in Windows 8, the changes related to Group Policy are more modest. One of these modest changes is in the Resultant Set of Policy (RSoP) functionality, exposed through the Group Policy Results Wizard in GPMC. This wizard was always my first “go-to” tool when trying to troubleshoot GP Processing problems, and they’ve made it more useful in Windows 8.

The first thing you’ll notice is that the Summary tab on RSoP is completely different, as shown here:

The ...

Continue Reading →
0

New Group Policy Freeware Utility Finds GPOs with Deny ACE

Posted by:

New Group Policy Freeware Utility Finds GPOs with Deny ACE

One of the challenges of the GPMC’s reporting is that it is not easy to find GPOs that have had Deny ACEs (Access Control Entries) set on their delegation. Deny ACEs are typically used to deny a particular user, computer or group from applying a GPO. I always recommend that they’re used on an exception basis, for the very reason that they are hard to spot after the fact and can cause increased complexity in your Group Policy deployments. Deny ACEs don’t ...

Continue Reading →
0

Digging Into Group Policy WMI Filters and Managing them through PowerShell

Posted by:

WMI Filters have been available as a mechanism for filtering the effects of Group Policy Objects (GPOs) since Server 2003 & XP shipped. They are a valuable tool in your Group Policy Management arsenal. As the name implies, WMI filters allow you to filter the effects of a GPO based on queries that execute against the WMI repository on a given client machine (server or workstation). A WMI filter needs to be expressed in terms of a WMI Query ...

Continue Reading →
3

SDM GPMC Cmdlets Updated to Support PowerShell v.2

Posted by:

When we created our GPMC PowerShell cmdlets in 2008, they made it easy to get at GPMC functionality within PowerShell v1. When Microsoft shipped Windows 7/2008-R2, they also provided their own set of GPMC-related cmdlets within their GroupPolicy module. At the time I assumed that most folks would continue to use our cmdlets on PowerShell v1 and especially on non-Win7 systems, but as it turns out, we still have a lot of folks using our cmdlets instead of Microsoft ones– most ...

Continue Reading →
16

Retrieving GPO Links with PowerShell

Posted by:

Retrieving GPO Links with PowerShell

Sometimes I’m reminded that, even though Microsoft has been shipping their Group Policy PowerShell module for a while now, it is missing some key functionality. Fortunately, it took someone else asking me a question about how they could script something in PowerShell to realize that our SDM GPMC cmdlets, which have been around since about 2008, have a pretty good set of functionality even in the era of Microsoft’s own module! The question I had today was, “how can ...

Continue Reading →
3

Getting Group Policy Counts with PowerShell

Posted by:

Sometimes you want to know how many GPOs you have in a domain. Powershell provides a way to do this quickly and easily. Earlier today I tweeted about the way to do this in Windows 7 or Server 2008-R2, using the Microsoft-provided “GroupPolicy” PowerShell Module. Its as simple as:

(Get-GPO -All).Count

However, if you are not yet on these newer OS versions, you can still get this information from PowerShell. Specifically, my free PowerShell GPMC cmdlets provide nearly identical syntax ...

Continue Reading →
0

More on Group Policy Backups and Version Compatibility

Posted by:

As a follow-on to my last blog post, here’s another interesting Group Policy Backup scenario to keep in mind. A user emailed that they were having problems importing a GPO backup that was created on a test Server 2008-R2 AD domain, into a Server 2003 AD domain. Theoretically this should work ok, but the user was getting non-descript errors about directory attributes not being found when they tried the import. I  scratched my head for a bit on this one and then ...

Continue Reading →
1