지금 지원 담당자와 채팅
지원 담당자와 채팅

GPOADmin 5.19 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Appendix: Windows PowerShell Commands

•
Introduction
•
GPOADmin scripts
•
Available commands
•
Using the GPOADmin PowerShell commands (Examples)

Introduction

The GPOADmin PowerShell commands are installed during a complete or custom installation. (Asssuming that you have Windows PowerShell currently installed.)

The GPOADmin provider and commands allow you to perform virtually all available functionality through a command line.

For detailed examples on using the commands, see Using the GPOADmin PowerShell commands (Examples).

Registering the GPOADmin PowerShell commands

Before you can use the commands, you must register them on the system where GPOADmin is installed.

To register the GPOADmin commands
1
Open a PowerShell window and type the following in the command prompt:
import-module ‘C:\Program Files\Quest\GPOADmin\GPOADmin.psd1’
2
Type the following in the PowerShell command prompt to verify that the snap-in was added:
get-command -module GPOADmin
All registered PowerShell commands display.
Loading the PowerShell provider
To load the GPOADmin PowerShell provider
1
Open PowerShell and run the following command:
Import-Module -Name <GPOADmin Install Directory>\GPOADmin.psd1.
Once the GPOADmin provider is loaded, it creates two default drives called "VCRoot" and "PSRoot".
PSRoot is the virtual directory created when Protected Settings policies are enabled for the specified server. All Protected Settings policy management and workflow actions are performed from here.
2
To access the drive, enter the following command: CD VCRoot: or CD PSRoot:
* 
NOTE: You must include the colon.
If you are running only the GPOADmin client, you must create a PSDrive mapped to the version control root to use the available PowerShell capabilities.
We recommend that all commands be run from the created PSDrive.
* 
NOTE: The account used in the credentials parameter must have permission to connect to the specified GPOADmin server. Permission is granted by adding the user as either a GPOADmin user or administrator on the Access tab of the targeted GPOADmin Server Properties dialog.
 
 
Table 18. Connection options
Connection requirement
Command

Connect to the Version Control Root of GPOADmin on this computer as the current user

New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root"

Connect to the Protected Settings Root of GPOADmin on this computer as the current user
New-PSDrive -Name "PSRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" –DriveType PSROOT

Connect to the Version Control Root of GPOADmin on this computer as a different user (a dialog appears prompting for the user password)
New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Credential “domain\user”

Connect to the Protected Settings Root of GPOADmin on this computer as a different user (a dialog appears prompting for the user password)
New-PSDrive -Name "PSRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" –DriveType PSROOT -Credential “domain\user”

Connect to the Version Control Root of GPOADmin on a different computer using the default port number as the current user

New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Server“server.domain.com”

Connect to the Protected Settings Root of GPOADmin on a different computer using the default port number as the current user

New-PSDrive -Name "PSRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" –DriveType PSROOT -Server“server.domain.com”

Connect to the Version Control Root of GPOADmin on a different computer using the default port number as a different user (a dialog appears prompting for the user password)

New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Server “server.domain.com” -Credential “domain\user”

Connect to the Protected Settings Root of GPOADmin on a different computer using the default port number as a different user (a dialog appears prompting for the user password)
New-PSDrive -Name "PSRoot" -PSProvider PSGPOADmin - Root "Protected Settings Root" –DriveType PSROOT -Server“server.domain.com” -Credential “domain\user”

Connect to the Version Control Root of a GPOADmin server on a different computer using a custom port number of 40201 as the current user

New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Server “server.domain.com” -Port 40201

Connect to the Protected Settings l Root of a GPOADmin server on a different computer using a custom port number of 40201 as the current user

New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" -Server “server.domain.com” -Port 40201

Connect to the Version Control Root of a GPOADmin server on a different computer using a custom port number of 40201 as a different user (a dialog appears prompting for the user password)

New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Server “server.domain.com” -Port 40201 -Credential “domain\user”

Connect to the Protected Settings Root of a GPOADmin server on a different computer using a custom port number of 40201 as a different user (a dialog appears prompting for the user password)

New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" -Server “server.domain.com” -Port 40201 -Credential “domain\user”

GPOADmin scripts

GPOADmin installs the following PowerShell scripts to c:\Program Files\Quest\GPOADmin\Scripts:

•
GPOADmin.AddServiceAccountToAllGPOs.ps1
•
GPOADmin.RunDynamicReport.ps1
•
GPOADmin.MinimumPermissions.ps1
GPOADmin.AddServiceAccountToAllGPOs.ps1

Grants the specified service account Edit settings, Delete, and Modify Security privileges and assigns ownership to all the GPOs in the specified domain.

Parameters
•
Domain: Specifies the DNS name of the domain in which to modify the GPOs.
•
ServiceAccount: Specifies the account, in domain\user format, that will be granted access to and made the owner of all the GPOs.
Syntax
GPOADmin.AddServiceAccountToAllGPOs -Domain <string> -ServiceAccount <string>
Example
GPOADmin.AddServiceAccountToAllGPOs -Domain "MyDomain.com" -ServiceAccount "mydomain\Service Account"
GPOADmin.RunDynamicReport.ps1

Runs a specified GPOADmin dynamic report and emails the results to a list of recipients.

Parameters
•
gpmServer: Specifies the GPOADmin server to connect to. (Optional)
•
gpmPort: Specifies the port number of the GPOADmin server. Default is 40200. (Optional)
•
DynamicReportFile: Specifies the path to the dynamic report file to run.
•
Recipients: Specifies the list of e-mail recipients.
Syntax
GPOADmin.RunDynamicReport.ps1 -Server <string> -Port <int> -DynamicReportFile <string> -Recipients <stringArray>
Example
GPOADmin.RunDynamicReport.ps1 -Server "localhost" -Port 40200 -DynamicReportFile "DynamicReport.xml" -Recipients ("recepient@company.com")
 
GPOADmin.MinimumPermissions.ps1

Sets, revokes, and reports on environment permissions for the service account.

Parameters
•
ServiceAccount: The service account in either domain\user or user@domain.com format.
•
Domain: The FQDN of the managed domain.
•
LDAPServer: The FQDN of the domain controller to be used.
•
Permissions: A comma delimited string of the permissions to be set, revoked, or reported on.
•
Delete: Grants "Delete Subtree”.
•
GPO: Grants "Create GPOs".
•
GPOEdit: Grants "Edit settings, Modify security, and Delete"
•
GPOOwner: Assigns the service account as the GPO owner.
•
GPOModel: Grants the ability for the service account to create the application directory for GPO Modeling Report and adds the service account to the Distributed COM users group.
•
Install: Grants "Full Control" to the install directory.
•
Link: Grants "Link GPOs".
•
Registry: Grants "Full Control" to HKLM\SOFTWARE\Quest\GPOADmin, grants "Query Value, Set Value, Create SubKey, Enumerate Subkeys, Delete, and Read Control" to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics and to HKLM\SYSTEM\CurrentControlSet\Service\EventLog.
•
Replication: Grants “Replicating directory changes" on the Default and Configuration naming contexts (for the Watcher Service).
•
RSoP: Grants "Read Group Policy Results Data" and "Perform Group Policy analysis".
•
SCP: Grants "Create and Delete serviceConnectionPoint objects".
•
Script: Grants "List folder contents, Read, and Write" to the Scripts container in SYSVOL.
•
SPN: Grants "Read and Write servicePrincipalName".
•
StarterGPO: Grants "Create Starter GPOs".
•
StarterGPOOwner: Assigns the service account as the Starter GPO owner.
•
WMI: Grants "Full Control" on all WMI Filters.
•
All: All of the above.
•
Confirm: Prompts for confirmation before granting or revoking permissions.
•
Revoke: Revokes the specified permissions.
•
Report: Reports whether the supplied service account as the specified permissions.
Syntax

GPOADmin.MinimumPermissions -ServiceAccount <string> -Domain <string> -LDAPServer <string> -Permissions <string> -Report <switch> -Revoke <switch> -Confirm <switch>

Example

GPOADmin.MinimumPermissions.ps1 -ServiceAccount "MyDomain\serviceaccount" -Domain "MyDomain.com" -LDAPServer "MyDC.MyDomain.com" -Permissions "All" -Report

Available commands

The following section lists all available GPOADmin commands. To see examples on how to use some of these commands, see Using the GPOADmin PowerShell commands (Examples) .

* 
NOTE:  
•
Items with a backslash or forward slash in the name will not manageable in PowerShell.
•
Items with an astrix in the name must inclose the name in single quotes and escape the astrix using the backtick character (character below the tilde).
For example:
Item Name: Test *
Escaped: 'Test `*'
To see a list of all available commands
•
Open PowerShell, load the GPOADmin provider, and run the following command:
get-command -module GPOADmin
To see command details including the required parameters, run the PowerShell get-help command. To see more detailed help, see Extracting help for GPOADmin commands .

 

Table 19. Available commands
Type

Add
•
Add-Administrator
•
Add-IntuneAssignments
•
Add-DomainSecurity
•
Add-EmailTemplates
•
Add-Keywords
•
Add-LiveEnvironmentSecurity
•
Add-ProtectedSettingsExclusions
•
Add-ProtectedSettingsPolicies
•
Add-RootContainerAssignment
•
Add-Role
•
Add-User

Clear
•
Clear-AssignedProtectedSettingsPolicies
•
Clear-ActionAccounts
•
Clear-BackupsByRetention
•
Clear-IntuneAssignments
•
Clear-DomainSecurity
•
Clear-ExchangeOptions -WorkflowOrSMTP
•
Clear-EmailTemplate
•
Clear-GmailOptions -WorkflowOrSMTP
•
Clear-IntuneOptions -TenantId
•
Clear-KeywordsList
•
Clear-LiveEnvironmentSecurity
•
Clear-Notifications
•
Clear-ProcessLock
•
Clear-ProtectedSettingsExclusions
•
Clear-RootContainerAssignment
•
Clear-SMTPOptions -WorkflowOrSMTP
•
Clear-SynchronizationTargets

Copy
•
Copy-ServerConfiguration

Get
•
Get-Administrators
•
Get-AllManagedObjects
•
Get-ApprovalWorkflow
•
Get-AssignedProtectedSettingsPolicies
•
Get-AssociatedItems
•
Get-Available
•
Get-BlockKeywordInheritance
•
Get-BlockProtectedSettingsInheritance
•
Get-ChangeAuditorDateRange
•
Get-ChangeAuditorService
•
Get-CheckedOut
•
Get-ChecktedOutToMe
•
Get-CloakedGPOs
•
Get-CommentMaximumLength
•
Get-CommentMinimumLength
•
Get-Compliance
•
Get-IntuneAssignments
•
Get-ContainerBlockKeywordInheritance
•
Get-ContainerKeywords
•
Get-CurrentUser
•
Get-DefaultLinkStateIsEnabled
•
Get-DeletedObjects
•
Get-Diagnostics
•
Get-DifferenceReport
•
Get-DisableAllGPOWorkflow
•
Get-DomainSecurity
•
Get-DSCRootPath
•
Get-DynamicReport
•
Get-EmailTemplates
•
Get-EnableAssociatedItemIdentification
•
Get-EnableApprovals
•
Get-EnableCustomWorkflowActions
•
Get-EnableDeploymentFailureAutomation
•
Get-EnableDSCSupport
•
Get-EnableGPOSynchronization
•
Get-EnableProtectedSettings
•
Get-EnableWMIFilterReadRestriction
•
Get-EnforceNamingStandards
•
Get-EnforceUniqueNames
•
Get-EnforceUniqueRoleNames
•
Get-EnsureServiceAccountAccess
•
Get-ExchangeOptions
•
Get-EnableFIPSMode
•
Get-FailedDeployment
•
Get-GmailOptions
•
Get-GPMCVersionCheck

 

 
•
Get-GPOLineage
•
Get-GPOLinks
•
Get-GPOLiveRegistrySettings
•
Get-GPOs
•
Get-ItemByID
•
Get-IntuneOptions
•
Get-KeywordsList
•
Get-LicenseInfo
•
Get-LinkedSOMs
•
Get-LiveEnvironmentSecurity
•
Get-LockedGPOs
•
Get-LoggingOptions
•
Get-NotificationEmailAddress
•
Get-NotificationList
•
Get-Notifications
•
Get-OrphanedWorkingCopies
•
Get-OuDisplayFormat
•
Get-OULinkContainers
•
Get-PendingApproval
•
Get-PendingDeployment
•
Get-Permissions
•
Get-PreferredDomainController
•
Get-Properties
•
Get-ProtectedSettingsBlockedExtensions
•
Get-ProtectedSettingsExclusions
•
Get-ProtectedSettingsExclusionsRecursion
•
Get-ProtectedSettingsPolicies
•
Get-RemediationRule
•
Get-Roles
•
Get-RootContainerAssignment
•
Get-Security
•
Get-SecurityFilter
•
Get-ServerConfiguration
•
Get-ServerDomain
•
Get-ServerVersion
•
Get-ServiceAccount
•
Get-SettingsReport
•
Get-SMTPOptions
•
Get-SQLTimeouts
•
Get-StarterGPOs
•
Get-StorageOptions
•
Get-SynchronizationTargets
•
Get-UnauthorizedModifications
•
Get-UnlinkedSOMs
•
Get-Unregistered
•
Get-Users

Get
•
Get-ValidScriptExtensions
•
Get-VCItemHistory
•
Get-WorkflowDisabledGPOs
•
Get-WorkflowDisabledSOMs
•
Get-WorkflowDisabledWMIFilters
•
Get-WorkflowEnabledGPOs
•
Get-WorkflowEnabledSOMs
•
Get-WorkflowEnabledWMIFilters

New
•
New-Container
•
New-DomainACE
•
New-EmailTemplate
•
New-EmailTemplateAttachment
•
New-GPOLink
•
New-IntuneAssignment
•
New-ProtectedSettingsPolicyAssignment
•
New-SyncTargetData
•
New-Trustee
•
New-VCAce

Push
•
Push-Notification

Remove
•
Remove-Administrator
•
Remove-Backups
•
Remove-IntuneAssignments
•
Remove-DomainAndObjects
•
Remove-DomainSecurity
•
Remove-EmailTemplates
•
Remove-GPOLink
•
Remove-Keywords
•
Remove-LiveEnvironmentSecurity
•
Remove-Role
•
Remove-RootContainerAssignment
•
Remove-User
•
Remove-ValidScriptExtensions

Reset
•
Reset-SynchronizationTargetCredentials

Select
•
Select-Approve
•
Select-Attest
•
Select-CancelDeployment
•
Select-CheckIn
•
Select-Checkout
•
Select-Cloak
•
Select-Deploy
•
Select-Delete
•
Select-Export
•
Select-ExportAsDSCResource
•
Select-ExportAsProtectedSettingsPolicy
•
Select-Import
•
Select-ImportSCMBackup
•
Select-Label
•
Select-Lock
•
Select-RecursiveRegistration
•
Select-RecursiveUnregistration
•
Select-Register
•
Select-Reject
•
Select-RequestApproval
•
Select-Restore
•
Select-ScheduledDeploy
•
Select-SearchAndReplaceGPO
•
Select-SynchronizeNow
•
Select-Uncloak
•
Select-UndoCheckout
•
Select-Unlock
•
Select-Unregister
•
Select-UnregisterAndRemoveHistory
•
Select-VerifyProtectedSettings
•
Select-WithdrawApproval
•
Select-WithdrawApprovalRequest
•
Select-WorkflowDisabled
•
Select-WorkflowEnabled

Set
•
Set-ApprovalWorkflow
•
Set-BackupsRetention
•
Set-BlockKeywordInheritance
•
Set-BlockProtectedSettingsInheritance
•
Set-ChangeAuditorDateRange
•
Set-ChangeAuditorService
•
Set-CommentMaximumLength
•
Set-CommentMinimumLength
•
Set-Compliance
•
Set-Configuration
•
Set-ContainerKeywords
•
Set-ContainerBlockKeywordInheritance
•
Set-DefaultLinkStateIsEnabled
•
Set-DSCRootPath
•
Set-DisableAllGPOWorkflow
•
Set-EmailTemplate
•
Set-EnableAssociatedItemIdentification
•
Set-EnableApprovals
•
Set-EnableCustomWorkflowActions
•
Set-EnableDeploymentFailureAutomation
•
Set-EnableDSCSupport
•
Set-EnableGPOSynchronization
•
Set-EnableProtectedSettings
•
Set-EnableUnregisteredSOMLinking
•
Set-EnableWMIFilterReadRestriction
•
Set-EnforceNamingStandards
•
Set-EnforceUniqueNames
•
Set-EnforceUniqueRoleNames
•
Set-EnsureServiceAccountAccess
•
Set-ExchangeOptions
•
Set-EnableFIPSMode
•
Set-GmailOptions
•
Set-GPMCVersionCheck
•
Set-GPOLineage
•
Set-IntuneOptions
•
Set-Keywords
•
Set-License
•
Set-LoggingOptions
•
Set-ManagedBy
•
Set-NotificationEmailAddress
•
Set-Notifications
•
Set-OuDisplayFormat
•
Set-OULinkContainers
•
Set-PreferredDomainController
•
Set-ProtectedSettingsBlockedExtensions
•
Set-ProtectedSettingsExclusionsRecursion

Set
•
Set-RemediationRule
•
Set-Role
•
Set-Security
•
Set-SecurityFilter
•
Set-SMTPOptions
•
Set-SQLTimeouts
•
Set-SynchronizationTargets
•
Set-ValidScriptExtensions

Switch
•
Switch-WatcherHashLocation
관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택