Hello,

Since Windows Server 2008 R2, Microsoft provided us a GroupPolicy PowerShell module. Thanks to this module, you can do some useful things like translate GPO Guid to friendly name, generate report in html or xml. Today we’ll export GPO settings for our domain, you can then use them for reporting or documentation purposes.

Export GPO Settings with PowerShell in Html

Export GPO Settings in HTML with PowerShell

Get-GPO -All | % {$_.GenerateReport('html') | Out-File "$($_.DisplayName).htm"}

Each of those htm file looks like this :

Exported GPO Settings with PowerShell

Invoke-Item InstallWindowsFeatureWSUS.htm

In those exports you’ll find the delegation settings, the links, security settings, details and all the GPO settings themselves. You can then use all of it as documentation for your Active Directory environment.

If you’re more comfortable with XML files, you can export GPO settings in XML too.

Export GPO Settings with PowerShell in XML

Export GPO Settings with PowerShell in XML

Get-GPO -All | % {$_.GenerateReport('xml') | Out-File "$($_.DisplayName).xml"}

You can then use them for GPO analyzing like an old script of mine.

Additional information

You need a 2008 R2/Windows 7 (or newer) computer to run it, but you can query an older Active Directory domain, as Windows Server 2003 or Windows Server 2008.

You can also query a remote domain or forest if you have you permissions to read GPO in the remote forest.

You don’t have to export all GPO’s, you can specify a few of them, take a look :

Get-GPO help