Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

GPOADmin 5.18 - User Guide

Table of Contents

Introducing Quest GPOADmin

GPOADmin features

Client/server architecture Multiforest support Group Policy Management Console extension Version control Change approval process Role-based delegation Notification system GPO ACL editor Reporting options Customized views Offline GPO testing Custom workflow actions

Configuring GPOADmin

Configuring the Version Control server Setting permissions on AD LDS Setting permissions when using SQL as the configuration store Port requirements Editing the Version Control server properties Editing the Version Control server configuration store Replacing the Version Control server configuration settings Migrating from AD/AD LDS to a SQL configuration store Changing the Service Account Root container assignment Restricting GPO management for specific domains Configuring role-based delegation

Creating roles Editing roles Delegating roles

Restricting access to objects Adding notifications for users Selecting events on which to be notified Restricting inheritance on notifications Creating email templates Working with Protected Settings policies

Rights and role for Protected Settings for GPOs Create a Protected Settings policy Protecting policy settings based on extensions Generating Protected Settings policies reports Using Protected Settings policies Checking a GPO against a Protected Settings policies and blocked extensions Validating a GPO against a Protected Settings policies and blocked extensions before a check-in

Connecting to the Version Control system

Restricting search scope Working with multiple connections Version Control data in the directory

Navigating the GPOADmin console Search folders

Creating custom search folders

Accessing the GPMC extension Configuring user preferences Working with the live environment

Registering objects Registered status Removing registered objects Viewing the live environment

Working with controlled objects (version control root)

Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects

Creating Group Policy Objects (GPOs) Creating starter GPOs Creating WMI filters Creating scripts Creating Desired State Configuration (DSC) PowerShell scripts

Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects

Creating labels Cloaking a GPO Locking a GPO Establishing Management for an Object Viewing history Deleting version history Clearing account names in version history Viewing and editing object properties Applying keywords on containers Creating a report

Working with available objects

Enabling/disabling workflow Checking out objects Requesting the deletion of an object Unregistering GPOs and removing history Requesting approval

Working with checked out objects

Undoing a check out Checking in controlled objects

Working with objects pending approval and deployment

Withdrawing an approval request Enhanced workflow approval Changing the approval workflow Withdrawing approval Approving and rejecting edits Deploying objects (scheduling and associated items)

Checking compliance Editing objects

Removing persistent registry settings

Editing Intune objects (configuration profiles and compliance policies) Editing WMI filters Editing scripts Linking GPOs

Synchronizing GPOs

Enabling synchronization Working with GPO synchronizations Generating Synchronized GPO report

Exporting and importing

Export objects Exporting GPO registry settings as a Desired State Configuration resource file Import objects

Creating Reports

Available reports

Controlled object reports

Settings Report Difference Report Group Policy Comparison Report History Report Group Policy Object Settings Search Report User Activity Report Role Assignment Report All Actions Report Compliance Report Change Auditor Report Change Auditor Working Copies Report Deployment Report Protected Settings Assignment Report Attestation Report Creating Controlled Object Reports

Diagnostic and troubleshooting reports

Group Policy Object Consistency Report Software Installation Package Report Linked/Unlinked Report Linked/Unlinked SOMs Report Inactive Policy Settings Report Group Policy Object Security Report Group Policy Permission Check Report Group Policy Size Validation Report Policy Analysis Report GPO Synchronization Report Group Policy Results Group Policy Results Difference Report Group Policy Modeling Report Creating Diagnostic and Troubleshooting Reports

Live, working copy, latest version, and differences reports

Creating live, working copy, latest version, and differences reports

Historical Settings Reports

Creating historical settings reports

Creating RSoP validation reports Exporting registry settings Working with report folders

Managing report folders

Appendix: Windows PowerShell Commands

Introduction GPOADmin scripts Available commands

GPOADmin PowerShell provider extensions

Using the GPOADmin PowerShell commands (Examples)

Loading the GPOADmin modules Extracting help for GPOADmin commands Managing objects

Get information on all GPOs Get information for all managed objects Get unregistered objects Register an object Check out an object Check in an object Undo the check out of an object Request approval for changes Withdraw an approval request Approve changes Reject changes Withdraw approval on an object Deploy an object Deploy an object at a future time and date Check for pending deployments Cancel pending deployment

Gathering object and GPOADmin information

Identify which objects are checked out Identify which objects are checked out to me What are the properties of an object What objects are available What objects are checked out

Utility commands

Gather GPOADmin license information Install a GPOADmin license Get logging options Set logging options Get notifications Set notifications on objects

Administrative commands

Approval workflow information Set the approval workflow Identify user accounts Identify user roles Modify a role Add a role Get an object's security Set an object's security Overwrite a GPOs security filter

Protected Settings commands

Gather Protected Settings information Enable and disable Protected Settings Get a list of Protected Settings Add Protected Settings

Appendix: GPOADmin Event Log

What is the GPOADmin event log? Interpreting the GPOADmin event log

Example GPOADmin events

Appendix: GPOADmin Backup and Recovery Procedures

GPOADmin Backup Requirements Restoring GPOADmin

Appendix: Customizing your workflow

What is a custom workflow action? Working with custom workflow actions in the Version Control system Working with the custom workflow actions xml file

Actions Predefined Tags Conditions Example of a complete pre-action

Troubleshooting custom workflow actions

Appendix: GPOADmin Silent Installation Commands

Installing GPOADmin with msiexec.exe

All components (Complete GPOADmin installation) Client and components

Server and client Client only Client and PowerShell provider (Client Only button on Installation dialog) PowerShell provider only

Watcher Service

Watcher Service on localhost Watcher Service on another computer Watcher Service and GPMC Extension on another computer Watcher Service and Client only on another computer Watcher Service, Client, and GPMC Extension on another computer

GPMC Extension on a localhost GPMC Extension on another computer

Appendix: Configuring Gmail for Notifications

Using Gmail for Workflow Approvals Creating a Gmail Credentials File

Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Configuring user preferences

Through user preferences, you can set where to store your reports, where to send notifications, and the default script editor.

To configure user preferences


	NOTE: You must configure user preferences in the GPOADmin console.

1

Right-click the forest, and select User Preferences.

2

Select the Preferences tab.

a

Choose a folder or disk where you want to store your reports.

b

By default, Notepad is configured for editing scripts. To set an alternative editor, click Add, and enter the script extension, the application, and optional switches to use.

3

Select the Notifications tab and enter the email address where you want to have the notification messages sent.

For more information on configuring the Notification system, see Selecting events on which to be notified.

4

To remove a notification, select the notification source and click the Remove button.

5

Working with the live environment

•

Registering objects

•

Registered status

•

Removing registered objects

•

Viewing the live environment

Registering objects

Registering objects

To start working with the Version Control system, the GPOs, starter GPOs, scripts, DSC scripts, WMI filters, and Scopes of Management (Sites, Domains, and Organizational Units) must be registered. You have the option to make GPOs workflow enabled at the time of registration and to maintain the version history of objects that were previously registered within GPOADmin.

Registering and unregistering are recursive for objects when they are selected from the treeview on the left of the console. All child objects are included unless you individually select lower-level objects to register.

You have the choice of registering all items in the selected container or domain, all GPOs, all scripts, all DSC scripts, or all WMI Filters when you use the Register menu. When you register objects at the domain level, you do not automatically register GPOs, scripts, DSC scripts, or WMI filters in the domain unless they are already linked to the Scopes of Management that are being registered. You can select WMI Filters, scripts, DSC scripts, and GPOs separately, using their respective folders.


	NOTE: Only users with the Register and Unregister rights can register and unregister objects. For more information, see Configuring role-based delegation .


	NOTE: Scripts contained in the SYSVOLS Scripts folder (and its subfolders) can be registered and will be detected by the Watcher Service and reported as non-compliant. DSC scripts are not monitored by the Watcher Service.

When an object is added to the system for the first time, it will be automatically backed up (stored) in the Version Control system history and labeled with a version of 1.0, unless another major version number is specified during the registration process. Each time a change is made (an object is checked in) a minor number is added. For example, v1.2, v1.3, and v1.4. When a change is deployed to the enterprise by a user with the appropriate role, the version number will change to the next major number, for example, v2.0 and v3.0.


	NOTE: GPOADmin works with pre-existing GPOs, scripts, DSC scripts, WMI filters, and Scopes of Management, as well as any other objects created from within the system. NOTE: If an object is not registered in version control, the modified date displayed is returned from the live object.


	NOTE: You must have the Register right and access to the Live Environment to perform the following steps.


	NOTE: Before you can register DSC scripts, you must enable DSC support in the Server options and specify a DSC root directory for each domain that will support DSC scripts. This root directory serves as the starting point for the DSC script enumeration and deployment location. See Editing the Version Control server properties .


	NOTE: The Starter GPOs folder is not created by default. To create the Starter GPOs folder, open Group Policy Manager, expand the required Domain \| Starter GPOs, and click Create Starter GPOs Folder.\|

To register objects using the GPOADmin console

1

Expand GPOADmin, the Live Environment, and domain nodes, and select the object you want to register within the Version Control system.

2

Right-click and select one of the following: Register - This Object Only, - All, - Group Policy Objects, - Scopes of Management, or - WMI Filters.

3

Select the container in which you want to place the registered object, or create a new container, and click OK.

Once the objects have been registered, they are located in the selected container under the Version Control Root with the initial version number set to 1.0. They are now available to be checked out and edited. You can set the major version number to any number greater than 1.0 (for example to maintain a version number if you are migrating from another Version Control system).

Users with the delegated rights can link registered GPOs to Scopes of Management (Sites, Domains, and Organizational Units) and add WMI Filters. For more information about linking GPOs, see Linking GPOs . For information about adding WMI Filters, see Creating Group Policy Objects (GPOs) .

To register GPOs using the GPMC Extension


	NOTE: You must use the GPOADmin console to register WMI filters and Scopes of Management.

Registering GPOs using the GPMC Extension is not recursive. If you want to register all child objects at once, use the GPOADmin console.

1

Expand the forest, domains, and domain nodes. Click the Group Policy Objects node, and select the GPO you want to register within the Version Control system.

2

Click Register.

3

Select the container in which you want to place the registered object and click OK.

Click New Container and name the container then click OK.

Registered status

Registered status

You can quickly see the status of registered GPOs, starter GPOs, scripts, DSC scripts, WMI filters, sites, domains, and OUs. The objects will either be available for check out, already checked out, or checked in and awaiting approval to be committed to the enterprise. The options available to you at each state will depend on your specific role and permission. Registered objects will be in one of the following states:

Table 12. Registered Status

From this state, depending on your assigned role and enabled options, you may have the ability to:

•

•

search and replace

•

•

•

import and export settings

•

import Security Compliance Manager Backup in group policies

•

request approval (for objects that have minor versions greater than zero)

•

deploy (for objects that have minor versions greater than zero)

•

•

cloak/uncloak GPOs

•

lock/unlock GPOs

•

enable/disable workflow for GPOs, SOMs, and WMI Filters

•

•

check compliance

•

unregister objects

•

protected setting - export

•

create and save reports dealing with latest, and live objects, and the difference between them

•

•

Synchronize – Synchronize Now, Set Synchronization Targets, and Validate Synchronization Results

•

edit object properties

•

refresh the object

•

•

•

mark objects for deletion

•

rename (This does not apply to SOMs.)

Table 13. Registered Status

From this state, depending on your assigned role and enabled options, you may have the ability to:

•

•

search and replace

•

•

check in objects

•

undo any check out

•

import and export settings

•

import Security Compliance Manager Backup in group policies

•

request approval (for objects that have minor versions greater than zero)

•

deploy (for objects that have minor versions greater than zero)

•

•

•

protected setting - export and verify

•

create and save reports dealing with latest, live, and working copy objects, and the difference between them

•

•

Synchronize – Synchronize Now, Set Synchronization Targets, and Validate Synchronization Results

•

edit object properties

•

refresh the object

•

•

•

rename (This does not apply to SOMs.)

Pending Approval

•

•

search and replace

•

export settings

•

withdraw approval request

•

approve changes

•

•

deploy the changes to the environment

•

•

•

protected setting - export

•

create and save reports dealing with latest and live objects, and the difference between them

•

•

Synchronize –Set Synchronization Targets, Validate Synchronization Results

•

edit object properties

•

refresh the object

•

•

Pending Deployment

•

•

search and replace

•

export settings

•

•

withdraw approval

•

deploy the changes to the environment

•

•

•

protected setting - export

•

create and save reports dealing with latest, and live objects, and the difference between them

•

•

Synchronize –Set Synchronization Targets, Validate Synchronization Results

•

edit object properties

•

refresh the object

•

•

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center