Chat now with support
Chat with Support

GPOADmin 5.13.5 - Getting Started Guide

Configuring the GPOADmin Server

The Version Control server must be configured before users can connect to the Version Control system.

Run All Programs | Quest | GPOADmin from the Start menu.
In the GPOADmin console, right-click the GPOADmin node and select Connect.
In the Connect to Server dialog box click Connect to connect with the current logged on user credentials or select the down arrow in the Connect button and select Connect As to enter new credentials (domain\user and password).
To save the credentials, select the Remember my password check box and click OK.
In the Select a Configuration Store dialog box, select AD LDS, Active Directory, or SQL for your configuration storage location.

Updating your license

If you want to upgrade your license (for example from a trial license) or you want to change your license for any reason, you can access the license information through the server properties.

Select the GPOADmin node, right-click and select Connect To, and connect to the console.
In the Options dialog expand License | Current License.
Check the Update License check box and browse to and select your updated license.

Setting Permissions on AD LDS

To use GPOADmin with an AD LDS deployment, users must be assigned the Administrator role.

In the Select a well known Naming Context, select Configuration, then enter the console and port number in the Computer box, and click OK.
Double-click Configuration to expand the configuration and browse to and select the Roles container.
To grant the users rights, right-click the Administrators role, and select Properties.

Editing the Version Control server properties

Users logged on with an account that is a member of the GPOADmin administrators group can edit the properties of the Version Control server when required. Specifically, they can:

Right-click the forest, and select Options.
Select Access to add and remove users who can connect to and alter the Version Control server options.
Select Administrators and add/remove users who can connect to and alter the Version Control server-specific settings.
Select Users and add/remove users who can connect to the Version Control server, but can only perform those actions that have been assigned by an administrator.
Select Storage to select the location of the physical backup copy of the various versions of an object.
Backup store location: This will store the backups in Active Directory if you selected it during the initial setup of GPOADmin as the storage method for your configuration.
AD LDS: This will store the backups in Active Directory Lightweight Directory Services (AD LDS).
NOTE: To use the same AD LDS instance for both the configuration and backup store, select the “Configuration store location” option on the Backup location page.
Network Share: Enter or browse to a network share or directory.
SQL Server: This will store the backups in SQL Server. Enter the database name and the required authentication.
To protect your environment from a SQL Injection attack, choose the SQL Input Filters option to specify which SQL statement inputs are not permitted within your deployment. By default, all of the inputs are marked as not permitted.
Choose the SQL Timeouts option to configure how long GPOADmin will wait to connect to the SQL server or to process a command.
Select Desired State Configuration | Root directory to specify a DSC root directory for each domain that supports DSC scripts. This root directory serves as the starting point for the DSC script enumeration and deployment location. DSC scripts cannot be registered until this option is enabled.
Select Delegation | Roles to create and edit roles that will be used to delegate rights over the Version Control system.
Select Notifications to configure email notifications on Version Controlled events. These notifications help you to stay informed of the latest changes to objects under version control.
Select SMTP to modify the global SMTP notification options.
Select to Enabled SMTP notifications.
Select Exchange to modify the mailbox and Exchange server information.
To do so, uncheck the Use the service accounts mailbox option. Enter the mailbox that you want to connect to, the account to use to connect to it, and the password for the account.
Select Enable workflow approval through email if you would like the ability to have changes approved and rejected through email.
Enter the Exchange Server Url or select Autodiscover Exchange Server Url to locate the Exchange server that is hosting the specified mailbox.
Select Logging | Configuration to enter the log location and the type of information you want to track.
Select Options to configure various settings.
Select General to configure the following options:

Perform Group Policy Management version check

Check to ensure the version of GPMC on the client is compatible with the GPMC version used within GPOADmin.

Disable all workflow options for Group Policy Objects

Disable all workflow on GPOs.

Keep in mind, if you disable the workflow, any changes made are immediately deployed in the live environment. To bring the GPO back under version control, enable the workflow.

Enable Protected Settings for Group Policy Objects

This enables the ability to have Protected Settings policies that contain settings that you want to control. They are protected in the sense that they contain and identify the settings that may not be altered by users. This provides an added level of security for the policies within your organization. If a user attempts to create, edit, or remove the flagged settings they will be stopped.

Set default link state to enable when adding new links

This enables the default link state for any new links added to a SOM.

Enable Group Policy Object Synchronization

Synchronizing GPOs allows you to automatically push out pre-defined “master GPO” settings to specified targets both within a forest and between two forests. This allows you to ensure specific GPOs, which are required in every domain, contain the same settings without having to link to a GPO outside of the domain.

You will be able to select one or more GPOs from various domains as synchronization targets for the source GPO. When the source GPO has been successfully deployed, the settings from the last major backup will be imported into each synchronization target GPO.

Enable Unique Name

This ensures that GPOs and WMI filters cannot be created with the same name as an existing GPOs or WMI filter in a domain, select the Enforce Unique Names option. If a non-deployed GPO indicates that a duplicate name exists, run a full compliance check to determine if any GPOs were modified outside of GPOADmin.

Enable unregistered Scopes of Management linking

To allows users to link to unregistered Scopes of Management, select the Enable unregistered Scope of Management linking option. If this option is not selected, the policy and the SOM must be registered and the user linking the policy must have the Link right on both objects.

Ensure service account access prior to deployment

This option must be enabled if you want users to be able to automatically deploy an object’s associated items.

It ensures that the service account has the Edit settings, delete, modify security rights on the working copy prior to deployment.

Enable the identification of associated items during deployment

Provides users with the option to identify and deploy associated items in a pending deployment state.

Display only the WMI Filters a user has Read access to when editing a GPO

Users will be restricted to only the WMI Filters they have Read access.

Enable the processing of custom workflow actions

Clicking on the Launch Editor button launches the Custom Workflow Editor.

Select SQL Input Filters to view the allowed strings and characters for SQL statements.
Select Preferred Domain Controllers and click Add to configure the domain controller that GPOADMin will use for all Active Directory actions. By default, GPOADmin uses the Primary Domain Controller.
Select Comments to enforce comments to all actions and naming conventions for newly created objects. Set a minimum comment length greater than 0. Leaving the value at 0 means comments are optional for all actions. Any value greater than zero makes comments mandatory for all actions and all users.
Select Naming Standards to enforce naming conventions for newly created objects. Select to apply the conventions to GPOs and/or WMI filters, and enter the pattern that you want to use.
You can test your rule, by entering a name that conforms to your desired naming standard and selecting Verify. If you validate the rule here, users will see both the rule and your sample text if they try to use a non-conforming name.
NOTE: Example rule


The caret character (^) means the start of the line.

The grouping [a-z]+ means at least one or more lower-case characters between a and z.

The grouping [0-9]+ means at least one or more numeric characters between 0 and 9.

The dollar sign character ($) means the end of the line.


This rule states that from the start of the line there must be at least one or more lower-case characters immediately followed by at least one or more numeric characters immediately followed by the literal string “_GPO” and nothing after that.


a1_GPO passes

abc123_GPO passes

_a1_GPO fails

a1_GPO_ fails

A1_GPO fails

A1_gpo fails

Select License | Current License to view the current license information.
Select the Update License check box and then click Browse and go to the new license location.
Select Integration to configure settings that apply to a Quest Change Auditor integration.
Related Documents