GPOADmin: Users Able to Create GPOs via PowerShell Despite Restrictions in Client (4383790)

A security configuration is in place within the domain to prevent certain users from creating new GPOs.

• The restriction works as expected when using the GPOADmin client UI.
• However, the same users can bypass this restriction and successfully create GPOs using PowerShell.

Example PowerShell Command

new-item -Path 'VCRoot:\Windows\TEST' -Name 'Test001' -ItemType GPO -Comment "Powershell Test GPO" -Domain "windows.lab" 

Observed Behavior

• Users without permission to create GPOs in the GPOADmin client:
  • ❌ Cannot create GPOs via UI (expected)
  • ✅ Can create GPOs via PowerShell (unexpected)

A defect has been logged with Quest Development:

• Defect ID: 650767
• Status: Open
• Fix: Planned for a future release of GPOADmin

At this time, there is no permanent fix available in released versions.

Workaround

Until a fix is available, consider the following mitigation strategies:

1. Restrict Access to GPOADmin PowerShell Provider

   • Limit which users can load or interact with the VCRoot PowerShell provider.
   • Control access via RBAC or endpoint restrictions.

2. Use Active Directory Delegation Controls

   • Ensure users do not have native AD permissions to create GPOs.
   • Validate permissions on:
     • Group Policy Objects container
     • Group Policy Creator Owners group

3. Monitor and Audit GPO Creation

   • Use tools such as Change Auditor to track:
     • GPO creation events
     • PowerShell-based changes

4. Operational Controls

   • Communicate internally that PowerShell usage can bypass the current enforcement.
   • Limit PowerShell usage to authorized administrators only.