Compare-SDMGPO -GPONameA “Default Domain Policy” -GPONameB “Default Domain Controllers Policy”
This command above, as it implies, will compare the settings in the Default Domain Policy GPO with those in the Default Domain Controllers Policy GPO in the current domain. The output of the comparison is a custom object that contains the path to the setting, the value in GPO A, the value in GPO B and the type of diference the item is (e.g. different between A & B, missing in A or missing in B). An example of the output is shown here:
Example output of a GPO Comparison in PowerShell
The cmdlet also provides other options, similar to the GUI. For example, you can pick different domains to compare GPOs against, you can compare both live and backup GPOs and you can alter the delimiter in the GPO path from the default “|” character to anything you choose. You can also choose to include or exclude (the default) metadata associated with the GPO. Metadata are things like links, security filters and GPO status.
The power of this cmdlet is in it ability to support bulk comparisons. For example, if you wanted to compare a large number of GPOs, it could be tedious to do that through the UI, but with PowerShell and Compare-SDMGPO, its a snap. And, if you want to output your comparisons to CSV, PowerShell makes it easy, like so:
compare-sdmgpo -GpoNameA “Default Domain Policy” -GpoNameB “Default Domain Controllers Policy” | export-csv c:datacompare1.csv
Gotta love when two great technologies–PowerShell and Group Policy–come together!
Darren
OCT
About the Author:
Darren Mar-Elia is CTO & Founder of SDM Software, Inc. Darren has over 25 years of IT and Software experience in the Microsoft technology area, including serving as a Director in Infrastructure at Charles Schwab, CTO of Windows Management Solutions at Quest Software, and Sr. Director of Product Engineering at DesktopStandard. He has been a Microsoft MVP in Group Policy technology for the last 6 years and has written and spoken on Active Directory, Group Policy and PowerShell topics frequently over the years. He maintains the popular Group Policy resource web site at www.gpoguy.com and has been a contributing editor for Windows IT Pro Magazine since 1997. He has written and contributed to twelve books on Windows. Darren also speaks frequently at conferences on Windows infrastructure topics.