Hello,
I made a nice function based on the “GroupPolicy” Powershell module provided by Windows 7/2008R2 and newer. This script will get GPO informations configurations and ACL in your Active Directory domain.
The output is a custom object with those properties :
You can use the function with :
- Get-GPOInfo -Verbose | Out-GridView -Title “GPO Report” #Display a nice table with all GPO’s and their informations.
- Get-GPOInfo | ? {$_.HasComputerSettings -and $_.HasUserSettings} #GPO with both settings.
- Get-GPOInfo | ? {$_.HasComputerSettings -and ($_.ComputerEnabled -eq $false)} #GPO with computer settings configured, but disabled.
- Get-GPOInfo | ? {$_.HasUserSettings -and ($_.UserEnabled -eq $false)} #GPO with user settings configured, but disabled.
- Get-GPOInfo | ? {$_.ComputerSettings -eq ‘NeverModified’ -and $_.UserSettings -eq ‘NeverModified’} #Never modified GPO.
- Get-GPOInfo | ? {$_.LinksTO -eq $null} #Unlinked GPO.
- Get-GPOInfo -DomainName Contoso.com #Query an other domain.
- Get-Help Get-GPOInfo -Full
Prerequisites :
- PowerShell 2 minimum.
- GroupPolicy module.
You can download the script on TechNet.