Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

GPOADmin 5.17 - User Guide

Table of Contents

Introducing Quest GPOADmin

GPOADmin features

Client/server architecture Multiforest support Group Policy Management Console extension Version control Change approval process Role-based delegation Notification system GPO ACL editor Reporting options Customized views Offline GPO testing Custom workflow actions

Configuring GPOADmin

Configuring the Version Control server Setting permissions on AD LDS Setting permissions when using SQL as the configuration store Port requirements Editing the Version Control server properties Editing the Version Control server configuration store Replacing the Version Control server configuration settings Migrating from AD/AD LDS to a SQL configuration store Changing the Service Account Root container assignment Restricting GPO management for specific domains Configuring role-based delegation

Creating roles Editing roles Delegating roles

Restricting access to objects Adding notifications for users Selecting events on which to be notified Restricting inheritance on notifications Creating email templates Working with Protected Settings policies

Rights and role for Protected Settings for GPOs Create a Protected Settings policy Protecting policy settings based on extensions Generating Protected Settings policies reports Using Protected Settings policies Checking a GPO against a Protected Settings policies and blocked extensions Validating a GPO against a Protected Settings policies and blocked extensions before a check-in

Connecting to the Version Control system

Restricting search scope Working with multiple connections Version Control data in the directory

Navigating the GPOADmin console Search folders

Creating custom search folders

Accessing the GPMC extension Configuring user preferences Working with the live environment

Registering objects Registered status Removing registered objects Viewing the live environment

Working with controlled objects (version control root)

Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects

Creating Group Policy Objects (GPOs) Creating starter GPOs Creating WMI filters Creating scripts Creating Desired State Configuration (DSC) PowerShell scripts

Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting when users can modify objects Working with registered objects

Creating labels Cloaking a GPO Locking a GPO Establishing Management for an Object Viewing history Deleting version history Clearing account names in version history Viewing and editing object properties Applying keywords on containers Creating a report

Working with available objects

Enabling/disabling workflow Checking out objects Requesting the deletion of an object Unregistering GPOs and removing history Requesting approval

Working with checked out objects

Undoing a check out Checking in controlled objects

Working with objects pending approval and deployment

Withdrawing an approval request Enhanced workflow approval Changing the approval workflow Withdrawing approval Approving and rejecting edits Deploying objects (scheduling and associated items)

Checking compliance Editing objects

Removing persistent registry settings

Editing Intune objects (configuration profiles and compliance policies) Editing WMI filters Editing scripts Linking GPOs

Synchronizing GPOs

Enabling synchronization Working with GPO synchronizations Generating Synchronized GPO report

Exporting and importing

Export objects Exporting GPO registry settings as a Desired State Configuration resource file Import objects

Creating Reports

Available reports

Controlled object reports

Settings Report Difference Report Group Policy Comparison Report History Report Group Policy Object Settings Search Report User Activity Report Role Assignment Report All Actions Report Compliance Report Change Auditor Report Change Auditor Working Copies Report Deployment Report Protected Settings Assignment Report Creating Controlled Object Reports

Diagnostic and troubleshooting reports

Group Policy Object Consistency Report Software Installation Package Report Linked/Unlinked Report Linked/Unlinked SOMs Report Inactive Policy Settings Report Group Policy Object Security Report Policy Analysis Report GPO Synchronization Report Group Policy Results Group Policy Results Difference Report Group Policy Modeling Report Creating Diagnostic and Troubleshooting Reports

Live, working copy, latest version, and differences reports

Creating live, working copy, latest version, and differences reports

Historical Settings Reports

Creating historical settings reports

Creating RSoP validation reports Exporting registry settings Working with report folders

Managing report folders

Appendix: Windows PowerShell Commands

Introduction GPOADmin scripts Available commands

GPOADmin PowerShell provider extensions

Using the GPOADmin PowerShell commands (Examples)

Loading the GPOADmin modules Extracting help for GPOADmin commands Managing objects

Get information on all GPOs Get information for all managed objects Get unregistered objects Register an object Check out an object Check in an object Undo the check out of an object Request approval for changes Withdraw an approval request Approve changes Reject changes Withdraw approval on an object Deploy an object Deploy an object at a future time and date Check for pending deployments Cancel pending deployment

Gathering object and GPOADmin information

Identify which objects are checked out Identify which objects are checked out to me What are the properties of an object What objects are available What objects are checked out

Utility commands

Gather GPOADmin license information Install a GPOADmin license Get logging options Set logging options Get notifications Set notifications on objects

Administrative commands

Approval workflow information Set the approval workflow Identify user accounts Identify user roles Modify a role Add a role Get an object's security Set an object's security Overwrite a GPOs security filter

Protected Settings commands

Gather Protected Settings information Enable and disable Protected Settings Get a list of Protected Settings Add Protected Settings

Appendix: GPOADmin Event Log

What is the GPOADmin event log? Interpreting the GPOADmin event log

Example GPOADmin events

Appendix: GPOADmin Backup and Recovery Procedures

GPOADmin Backup Requirements Restoring GPOADmin

Appendix: Customizing your workflow

What is a custom workflow action? Working with custom workflow actions in the Version Control system Working with the custom workflow actions xml file

Actions Predefined Tags Conditions Example of a complete pre-action

Troubleshooting custom workflow actions

Appendix: GPOADmin Silent Installation Commands

Installing GPOADmin with msiexec.exe

All components (Complete GPOADmin installation) Client and components

Server and client Client only Client and PowerShell provider (Client Only button on Installation dialog) PowerShell provider only

Watcher Service

Watcher Service on localhost Watcher Service on another computer Watcher Service and GPMC Extension on another computer Watcher Service and Client only on another computer Watcher Service, Client, and GPMC Extension on another computer

GPMC Extension on a localhost GPMC Extension on another computer

Appendix: Configuring Gmail for Notifications

Using Gmail for Workflow Approvals Creating a Gmail Credentials File

Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Introduction

The GPOADmin PowerShell commands are installed during a complete or custom installation. (Asssuming that you have Windows PowerShell currently installed.)

The GPOADmin provider and commands allow you to perform virtually all available functionality through a command line.

For detailed examples on using the commands, see Using the GPOADmin PowerShell commands (Examples).

Registering the GPOADmin PowerShell commands

Before you can use the commands, you must register them on the system where GPOADmin is installed.

To register the GPOADmin commands

1

Open a PowerShell window and type the following in the command prompt:

import-module ‘C:\Program Files\Quest\GPOADmin\GPOADmin.psd1’

2

Type the following in the PowerShell command prompt to verify that the snap-in was added:

get-command -module GPOADmin

All registered PowerShell commands display.

Loading the PowerShell provider

To load the GPOADmin PowerShell provider

1

Open PowerShell and run the following command:

Import-Module -Name <GPOADmin Install Directory>\GPOADmin.psd1.
Once the GPOADmin provider is loaded, it creates two default drives called "VCRoot" and "PSRoot".

PSRoot is the virtual directory created when Protected Settings policies are enabled for the specified server. All Protected Settings policy management and workflow actions are performed from here.

2

To access the drive, enter the following command: CD VCRoot: or CD PSRoot:


	NOTE: You must include the colon.

If you are running only the GPOADmin client, you must create a PSDrive mapped to the version control root to use the available PowerShell capabilities.

We recommend that all commands be run from the created PSDrive.


	NOTE: The account used in the credentials parameter must have permission to connect to the specified GPOADmin server. Permission is granted by adding the user as either a GPOADmin user or administrator on the Access tab of the targeted GPOADmin Server Properties dialog.

Table 18. Connection options


Connection requirement	Command
Connect to the Version Control Root of GPOADmin on this computer as the current user	New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root"
Connect to the Protected Settings Root of GPOADmin on this computer as the current user	New-PSDrive -Name "PSRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" –DriveType PSROOT
Connect to the Version Control Root of GPOADmin on this computer as a different user (a dialog appears prompting for the user password)	New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Credential “domain\user”
Connect to the Protected Settings Root of GPOADmin on this computer as a different user (a dialog appears prompting for the user password)	New-PSDrive -Name "PSRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" –DriveType PSROOT -Credential “domain\user”
Connect to the Version Control Root of GPOADmin on a different computer using the default port number as the current user	New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Server“server.domain.com”
Connect to the Protected Settings Root of GPOADmin on a different computer using the default port number as the current user	New-PSDrive -Name "PSRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" –DriveType PSROOT -Server“server.domain.com”
Connect to the Version Control Root of GPOADmin on a different computer using the default port number as a different user (a dialog appears prompting for the user password)	New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Server “server.domain.com” -Credential “domain\user”
Connect to the Protected Settings Root of GPOADmin on a different computer using the default port number as a different user (a dialog appears prompting for the user password)	New-PSDrive -Name "PSRoot" -PSProvider PSGPOADmin - Root "Protected Settings Root" –DriveType PSROOT -Server“server.domain.com” -Credential “domain\user”
Connect to the Version Control Root of a GPOADmin server on a different computer using a custom port number of 40201 as the current user	New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Server “server.domain.com” -Port 40201
Connect to the Protected Settings l Root of a GPOADmin server on a different computer using a custom port number of 40201 as the current user	New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" -Server “server.domain.com” -Port 40201
Connect to the Version Control Root of a GPOADmin server on a different computer using a custom port number of 40201 as a different user (a dialog appears prompting for the user password)	New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Version Control Root" -Server “server.domain.com” -Port 40201 -Credential “domain\user”
Connect to the Protected Settings Root of a GPOADmin server on a different computer using a custom port number of 40201 as a different user (a dialog appears prompting for the user password)	New-PSDrive -Name "VCRoot" -PSProvider PSGPOADmin -Root "Protected Settings Root" -Server “server.domain.com” -Port 40201 -Credential “domain\user”

GPOADmin scripts

GPOADmin installs the following PowerShell scripts to c:\Program Files\Quest\GPOADmin\Scripts:

•

GPOADmin.AddServiceAccountToAllGPOs.ps1

•

GPOADmin.RunDynamicReport.ps1

GPOADmin.AddServiceAccountToAllGPOs.ps1

Grants the specified service account Edit settings, Delete, and Modify Security privileges and assigns ownership to all the GPOs in the specified domain.

•

Domain: Specifies the DNS name of the domain in which to modify the GPOs.

•

ServiceAccount: Specifies the account, in domain\user format, that will be granted access to and made the owner of all the GPOs.

GPOADmin.AddServiceAccountToAllGPOs -Domain <string> -ServiceAccount <string>

GPOADmin.AddServiceAccountToAllGPOs -Domain "MyDomain.com" -ServiceAccount "mydomain\Service Account"

GPOADmin.RunDynamicReport.ps1

Runs a specified GPOADmin dynamic report and emails the results to a list of recipients.

•

gpmServer: Specifies the GPOADmin server to connect to. (Optional)

•

gpmPort: Specifies the port number of the GPOADmin server. Default is 40200. (Optional)

•

DynamicReportFile: Specifies the path to the dynamic report file to run.

•

Recipients: Specifies the list of e-mail recipients.

GPOADmin.RunDynamicReport.ps1 -Server <string> -Port <int> -DynamicReportFile <string> -Recipients <stringArray>

GPOADmin.RunDynamicReport.ps1 -Server "localhost" -Port 40200 -DynamicReportFile "DynamicReport.xml" -Recipients ("recepient@company.com")

Available commands

The following section lists all available GPOADmin commands. To see examples on how to use some of these commands, see Using the GPOADmin PowerShell commands (Examples) .

NOTE:

•

Items with a backslash or forward slash in the name will not manageable in PowerShell.

•

Items with an astrix in the name must inclose the name in single quotes and escape the astrix using the backtick character (character below the tilde).

Item Name: Test *

Escaped: 'Test `*'

To see a list of all available commands

•

Open PowerShell, load the GPOADmin provider, and run the following command:

get-command -module GPOADmin

To see command details including the required parameters, run the PowerShell get-help command. To see more detailed help, see Extracting help for GPOADmin commands .

Table 19. Available commands

•

Add-Administrator

•

Add-IntuneAssignments

•

Add-DomainSecurity

•

Add-EmailTemplates

•

•

Add-LiveEnvironmentSecurity

•

Add-ProtectedSettingsExclusions

•

Add-ProtectedSettingsPolicies

•

Add-RootContainerAssignment

•

•

•

Clear-AssignedProtectedSettingsPolicies

•

Clear-ActionAccounts

•

Clear-BackupsByRetention

•

Clear-IntuneAssignments

•

Clear-DomainSecurity

•

Clear-ExchangeOptions -WorkflowOrSMTP

•

Clear-EmailTemplate

•

Clear-GmailOptions -WorkflowOrSMTP

•

Clear-IntuneOptions -TenantId

•

Clear-KeywordsList

•

Clear-LiveEnvironmentSecurity

•

Clear-Notifications

•

Clear-ProcessLock

•

Clear-ProtectedSettingsExclusions

•

Clear-RootContainerAssignment

•

Clear-SMTPOptions -WorkflowOrSMTP

•

Clear-SynchronizationTargets

•

Copy-ServerConfiguration

•

Get-Administrators

•

Get-AllManagedObjects

•

Get-ApprovalWorkflow

•

Get-AssignedProtectedSettingsPolicies

•

Get-AssociatedItems

•

•

Get-BlockKeywordInheritance

•

Get-BlockProtectedSettingsInheritance

•

Get-ChangeAuditorDateRange

•

Get-ChangeAuditorService

•

•

Get-ChecktedOutToMe

•

Get-CloakedGPOs

•

Get-CommentMaximumLength

•

Get-CommentMinimumLength

•

•

Get-IntuneAssignments

•

Get-ContainerBlockKeywordInheritance

•

Get-ContainerKeywords

•

Get-CurrentUser

•

Get-DefaultLinkStateIsEnabled

•

Get-DeletedObjects

•

Get-Diagnostics

•

Get-DifferenceReport

•

Get-DisableAllGPOWorkflow

•

Get-DomainSecurity

•

Get-DSCRootPath

•

Get-DynamicReport

•

Get-EmailTemplates

•

Get-EnableAssociatedItemIdentification

•

Get-EnableApprovals

•

Get-EnableCustomWorkflowActions

•

Get-EnableDeploymentFailureAutomation

•

Get-EnableDSCSupport

•

Get-EnableGPOSynchronization

•

Get-EnableProtectedSettings

•

Get-EnableWMIFilterReadRestriction

•

Get-EnforceNamingStandards

•

Get-EnforceUniqueNames

•

Get-EnforceUniqueRoleNames

•

Get-EnsureServiceAccountAccess

•

Get-ExchangeOptions

•

Get-EnableFIPSMode

•

Get-FailedDeployment

•

Get-GmailOptions

•

Get-GPMCVersionCheck

•

•

•

Get-GPOLiveRegistrySettings

•

•

•

Get-IntuneOptions

•

Get-KeywordsList

•

Get-LicenseInfo

•

•

Get-LiveEnvironmentSecurity

•

•

Get-LoggingOptions

•

Get-NotificationEmailAddress

•

Get-NotificationList

•

Get-Notifications

•

Get-OrphanedWorkingCopies

•

Get-OuDisplayFormat

•

Get-PendingApproval

•

Get-PendingDeployment

•

Get-Permissions

•

Get-PreferredDomainController

•

•

Get-ProtectedSettingsBlockedExtensions

•

Get-ProtectedSettingsExclusions

•

Get-ProtectedSettingsExclusionsRecursion

•

Get-ProtectedSettingsPolicies

•

Get-RemediationRule

•

•

Get-RootContainerAssignment

•

•

Get-SecurityFilter

•

Get-ServerConfiguration

•

Get-ServerDomain

•

Get-ServerVersion

•

Get-ServiceAccount

•

Get-SettingsReport

•

Get-SMTPOptions

•

Get-SQLTimeouts

•

Get-StarterGPOs

•

Get-StorageOptions

•

Get-SynchronizationTargets

•

Get-UnauthorizedModifications

•

Get-UnlinkedSOMs

•

Get-Unregistered

•

•

Get-ValidScriptExtensions

•

Get-VCItemHistory

•

Get-WorkflowDisabledGPOs

•

Get-WorkflowDisabledSOMs

•

Get-WorkflowDisabledWMIFilters

•

Get-WorkflowEnabledGPOs

•

Get-WorkflowEnabledSOMs

•

Get-WorkflowEnabledWMIFilters

•

•

•

New-EmailTemplate

•

New-EmailTemplateAttachment

•

•

New-IntuneAssignment

•

New-ProtectedSettingsPolicyAssignment

•

New-SyncTargetData

•

•

•

Push-Notification

•

Remove-Administrator

•

•

Remove-IntuneAssignments

•

Remove-DomainSecurity

•

Remove-EmailTemplates

•

•

Remove-Keywords

•

Remove-LiveEnvironmentSecurity

•

•

Remove-RootContainerAssignment

•

•

Remove-ValidScriptExtensions

•

Reset-SynchronizationTargetCredentials

•

•

Select-CancelDeployment

•

•

Select-Checkout

•

•

•

•

Select-ExportAsDSCResource

•

Select-ExportAsProtectedSettingsPolicy

•

•

Select-ImportSCMBackup

•

•

•

Select-RecursiveRegistration

•

Select-RecursiveUnregistration

•

Select-Register

•

•

Select-RequestApproval

•

•

Select-ScheduledDeploy

•

Select-SearchAndReplaceGPO

•

Select-SynchronizeNow

•

•

Select-UndoCheckout

•

•

Select-Unregister

•

Select-UnregisterAndRemoveHistory

•

Select-VerifyProtectedSettings

•

Select-WithdrawApproval

•

Select-WithdrawApprovalRequest

•

Select-WorkflowDisabled

•

Select-WorkflowEnabled

•

Set-ApprovalWorkflow

•

Set-BackupsRetention

•

Set-BlockKeywordInheritance

•

Set-BlockProtectedSettingsInheritance

•

Set-ChangeAuditorDateRange

•

Set-ChangeAuditorService

•

Set-CommentMaximumLength

•

Set-CommentMinimumLength

•

•

Set-Configuration

•

Set-ContainerKeywords

•

Set-ContainerBlockKeywordInheritance

•

Set-DefaultLinkStateIsEnabled

•

Set-DSCRootPath

•

Set-DisableAllGPOWorkflow

•

Set-EmailTemplate

•

Set-EnableAssociatedItemIdentification

•

Set-EnableApprovals

•

Set-EnableCustomWorkflowActions

•

Set-EnableDeploymentFailureAutomation

•

Set-EnableDSCSupport

•

Set-EnableGPOSynchronization

•

Set-EnableProtectedSettings

•

Set-EnableUnregisteredSOMLinking

•

Set-EnableWMIFilterReadRestriction

•

Set-EnforceNamingStandards

•

Set-EnforceUniqueNames

•

Set-EnforceUniqueRoleNames

•

Set-EnsureServiceAccountAccess

•

Set-ExchangeOptions

•

Set-EnableFIPSMode

•

Set-GmailOptions

•

Set-GPMCVersionCheck

•

•

Set-IntuneOptions

•

•

•

Set-LoggingOptions

•

•

Set-NotificationEmailAddress

•

Set-Notifications

•

Set-OuDisplayFormat

•

Set-PreferredDomainController

•

Set-ProtectedSettingsBlockedExtensions

•

Set-ProtectedSettingsExclusionsRecursion

•

Set-RemediationRule

•

•

•

Set-SecurityFilter

•

Set-SMTPOptions

•

Set-SQLTimeouts

•

Set-SynchronizationTargets

•

Set-ValidScriptExtensions

•

Switch-WatcherHashLocation

GPOADmin PowerShell provider extensions

GPOADmin has extended the following standard PowerShell commands:

•

New-Item and Remove-Item

•

Get-ChildItem and the New-PSDrive

New-Item and Remove-Item

GPOADmin has extended Microsoft’s New-Item and Remove-Item PowerShell commands to add the ability to create and delete items from the GPOADmin version control.

Example: Create a container name HR

new-item -Path VCRoot:\ -Name HR -ItemType Container

Example: Create a GPO name HR_GPO in the HR container

new-item -Path VCRoot:\HR -Name HR_GPO -ItemType GPO -Comment "Set the minimum password length to 8 characters"

Example: Remove the GPO name HR_GPO in the HR container

remove-item -Path vcroot:\HR\HR_GPO

Example: Remove a container name HR

remove-item -Path VCRoot:\HR

Get-ChildItem and the New-PSDrive

The GPOADmin PowerShell provider has extended the Get-ChildItem and the New-PSDrive command to include the following parameters:

Table 20. Commands

Get-ChildItem extensions

NOTE: If no parameters are specified, then all objects are enumerated and returned.

•

Container: Returns Version Control containers.

•

Domain: Returns domain scopes of management.

•

GPO: Returns Group Policy Objects.

•

OrganizationalUnit: Returns Organizational Units.

•

Site: Returns site scopes of management.

•

SOM: Returns all scopes of management (domain, Organizational Units, and sites).

•

WMIFilter: Returns WMIFilters.

•

Count: Instructs the provider to return only the number of specified objects.

New-PSDrive extensions

•

Server: Specifies the GPOADmin server service to connect to.

•

Port: Specifies the port to use when connecting to the specified server.

•

Path: The fully qualified path to the new item.

•

ItemTypeName: The type of item to create. Valid values are:

•

Version Control Root: CONTAINER, GPO, STARTERGPO, WMIFILTER, SCRIPT, and POWERSHELLSCRIPT.

•

Protected Settings Root: CONTAINER and PROTECTEDSETTINGSPOLICY.

•

Domain: The domain in which the new item belongs.

•

Comment: A comment to associate with the creation of this item.

•

WorkflowDisabled: Creates the item as Workflow Disabled. Valid only with an ItemTypeName of GPO.

•

StarterGPO: The StarterGPOData representing the StarterGPO to use when creating a new GPO. Valid only with an ItemTypeName of GPO.

•

WMIFilter: The VersionControlledData representing the WMIFilter to be linked to this item. Valid only with an ItemTypeName of GPO.

•

Queries: The queries to be associated with this item. Valid only with an ItemTypeName of WMIFILTER

•

Description: The description for this item. Valid only with an ItemTypeName of WMIFILTER.

•

Comment: A comment to associate with this item.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center