Chat now with support
Chat with Support

GPOADmin 5.18 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Predefined Tags

Tags are typically replaced with their corresponding values by the service. However, there are cases where the tags will not be converted. For example, if a comment is not specified during the version control action then the [COMMENT] tag will be empty; or if the object is not checked out then the [TRUSTEENAME] and [TRUSTEESID] will be empty.

Keep in mind that in some cases the tags will always be empty as is the case of a pre-action for the Register version control action. At the time the pre-action is processed, the corresponding version control information would not exist.

* 
NOTE: Tags must be uppercase and enclosed in square brackets.

Parameters and conditions support the following predefined tags:

Table 25. Available tags
Tag
Description

[ACTION]

The currently executing version control action.

[VCID]

The version control identifier of the current object.

[DOMAINNAME]

The name of the domain for the current object.

[FULLPATH]

The full path of the current object in the version control system.

[ID]

The identifier for the current object.

[LASTBACKUPID]

The identifier of the last backup for the current object.

[NAME]

The name of the current object.

[STATUS]

The version control status for the current object. See Status values for more information.

[SUBSTATUS]

The version control sub status for the current object.See Sub status values for more information.

[TRUSTEENAME]

The name of the user the current object is checked out to.

[TRUSTEESID]

The SID of the user the current object is checked out to.

[TYPE]

The version control type of the current object.

[VERSION]

The version of the current object.

[COMMENT]

The comment associated with the version control action.

Sub status values

The possible values of a registered object's sub status include the following:

Table 26. Substatus values
Value
Description

None

Default.

Register

Registers objects with the version control system.

Unregister

Unregisters objects from the version control system.

CheckIn

Save edits made to an object in the version control system.

CheckOut

Prepares an object in the version control system for editing.

UndoCheckOut

Discards change made to an object in the version control system.

RollBack

Restores an object in the version control system to a previous known state.

Restore

Restores an object in the version control system to a previous known state.

Get

 

Overwrites the current settings of an object in the version control system with settings from a previous known sate.

Import

 

Overwrites the current settings of an object in the version control system with settings from a previous backup.

IncorporateLive

 

Overwrites the current settings of an object in the version control system with those from the live environment.

Create

Creates a new object in the version control system.

Branch

Branch on object.

Edit

Edits an object in the version control system.

Delete

Marks an object in the version control system as deleted.

Approve

Approves changes made to an object in the version control system.

Reject

Rejects changes made to an object in the version control system.

RequestApproval

Request approval for changes made to an object in the version control system.

ApplyPolicyTemplate

Applies a template to a policy in the version control system.

Label

Labels objects in the version control system.

Lock

Locks an object in the version control system.

Unlock

Unlocks an object in the version control system.

Cloak

Cloaks an object in the version control system.

Uncloak

Uncloaks an object in the version control system.

EnableWorkflow

Forces the object to follow version control workflow.

DisableWorkflow

Allows the object to not follow version control workflow.

Move

Moves an object from one container to another in the version control system.

WithdrawApproval

Withdraws approval of changes for an object in the version control system.

WithdrawApprovalRequest

Withdraws an approval request for changes to an object in the version control system.

Rename

Renames an object in the version control system.

SubmitScheduledApproval

Submits approval for scheduled deployment of an object in the version control system.

CancelScheduledApproval

Cancels a scheduled deployment of an object in the version control system.

Deploy

Deploys an object in the version control system to the live environment.

Link

Links a policy object to a scope of management in the version control system.

LinkUpdate

Updates the links on a scope of management.

ComplianceAction

An action which affects the compliance of an object in the version control system.

ModifySecurity

Modifies the security of an object in the version control system.

UnauthorizedModifications

A backup of a noncompliant object. This is intended to be done by the Watcher Service.

MigrationAction

Indicates an import from NetPro GPOADmin. This is intended to be done by the Migration Wizard.

Synchronization

Synchronizes a source object to one or more targets of the same type.

ToggleApprovalWorkflow

Toggles the order of approval workflow processing.

FailedDeployment

A deployment has failed.

Status values

The possible values of a version controlled object’s status include the following:

Table 27.  
Status Value
Description

Unregistered

The object is unregistered.

Available

The version controlled object is available.

CheckedOut

The version controlled object is checked out.

Pending

 

The version controlled object is in a pending state. Check the substatus for more information.

PendingDeployment

The version controlled object is pending deployment.

Deleted

The version controlled object is flagged as deleted.

Error

The version controlled object is in error.

ErrorNoWorkingCopy

The version controlled object does not have an associated working copy.

Cloaked

The version controlled object is cloaked

Locked

The version controlled object is locked.

Noncompliant

The version controlled object is noncompliant.

Noncompliant_Deleted

The version controlled object is noncompliant because it was deleted.

Noncompliant_Moved

The version controlled object is noncompliant because it was moved.

Moved

The version controlled object has been moved. This status only applies to OUs.

Unknown

The version controlled objects status is unknown.

Conditions

Whether or not an action is processed can be controlled by the use of conditions. A condition must evaluate to true in order for the action to be processed. If the condition evaluates to false then a log entry stating such is created and the current custom workflow action is not processed.

Each condition node has the following properties:

Table 28. Condition properties
Property
Description

DataType

The data type of the property being compared.

Value1

The left side of the comparison.

Value2

The right side of the comparison.

Operator

The operation to perform. Options depend on the DataType.

IgnoreCase

 

This is only valid for the string DataType. This property instructs the service to perform any string operations case insensitively.

The type of operations available depends on the DataType property.

The following DataTypes are available:

Table 29. DataTypes
DataType
Description

String

This condition is performed on a string.

Guid

This condition is performed on a Guid.

Version

The condition is performed on a version.

The following operations are available for a String DataType:

Table 30.  
String operator
Description

equal

Determines whether or not Value1 and Value2 have the same value.

not equal

Determines whether or not Value1 and Value2 are different.

contains

Determines whether or not Value2 is present in Value1

not contains

Determines whether or not Value2 is missing from Value1.

starts with

Determines whether or not Value1 starts with Value2.

not starts with

Determines whether or not Value1 does not start with Value2.

ends with

Determines whether or not Value1 ends with Value2.

not ends with

Determines whether or not Value1 does not end with Value2.

The following operations are available for a Guid DataType:

Table 31. Guid operators
Guid operator
Description

equal

Determines whether or not Value1 and Value2 have the same value.

not equal

Determines whether or not Value1 and Value2 are different.

The following operations are available for a Version DataType:

Table 32. Version operators
Version operator
Description

equal

Determines whether or not Value1 and Value2 have the same value.

not equal

Determines whether or not Value1 and Value2 are different.

greater than

Determines whether or not Value1 is greater than Value2.

greater than or equals

Determines whether or not Value1 is greater than or equal to Value2.

less than

Determines whether or not Value1 is lesser than Value2.

less than or equals

Determines whether or not Value1 is lesser than or equal to Value2.

The available logical operators include:

Table 33. Operators
Operator
Description

And

Logically ANDs to conditions.

Or

Logically ORs to conditions.

The logical operators ‘And’ and ‘Or’ function sequentially and grouping is not supported. For example:

Condition1 And Condition2 Or Condition3

would be processed as:

(Condition1 And Condition2) Or Condition3

not as:

Condition1 And (Condition2 Or Condition3)

To use a logical “And” or “Or” operator, specify a new Condition with only the Operator property.

For example:

<Condition Operator="And"/>
<Condition Operator="Or"/>

Example of a complete pre-action

The following example demonstrates a pre-action that creates a CheckIn directory below the GPOSettingsReports directory provided that the name of the version controlled object contains an underscore and the version is less than 4.5 or the comment ends with “_AMER”.

 
<?xml version="1.0" encoding="utf-8"?>
<CustomWorkflowActions>
<CheckIn>
<PreActions>
<Action Name="CheckIn pre-action" Comment="A custom action." StopOnError="false">
<Executable>c:\windows\system32\cmd.exe</Executable>
<Parameters>/C mkdir "c:\GPOSettingsReports\CheckIn"</Parameters>
<Conditions>
<Condition DataType="String" Value1="[NAME]" Operator="contains" Value2="_" IgnoreCase='true'/>
<Condition Operator="And"/>
<Condition DataType="Version" Value1="[VERSION]" Operator="less than" Value2="4.5"/>
<Condition Operator="Or"/>
<Condition DataType="String" Value1="[COMMENT]" Operator="ends with" Value2="_AMER"/>
</Conditions>
</Action>
</PreActions>
<PostActions>
</PostActions>
</CheckIn>
</CustomWorkflowActions>

Troubleshooting custom workflow actions

Because custom workflow actions are performed in the background by the GPOADmin service, they will not be visible from the interface. However, you can use the logs to assess any issues. When a custom workflow action is processed, the Standard Output and Error streams are redirected and logged as part of the server actions provided the Debug logging option is enabled.

* 
NOTE: Depending on the custom workflow action, there can be a large amount of data written to the logs. It is strongly recommended that all custom workflow actions be thoroughly tested by a user who has access to the GPOADmin server logs.

 

Table 34. Event IDs and corresponding source
Event ID
Source

2013

GPOADmin server process – Information

2014

GPOADmin server process – Errors

2015

Custom Workflow Action process – Standard Output stream

2016

Custom Workflow Actions process – Error stream

 

 
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating