Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

GPOADmin 5.13.5 - User Guide

Table of Contents

Introducing Quest GPOADmin

GPOADmin features

Client/server architecture Multiforest support Group Policy Management Console extension Version control Change approval process Role-based delegation Notification system GPO ACL editor Reporting options Customized views Offline GPO testing Custom workflow actions GPOADmin Dashboard

Configuring GPOADmin

Configuring the Version Control server Setting permissions on AD LDS Setting permissions when using SQL as the configuration store Port requirements Editing the Version Control server properties Editing the Version Control server configuration store Migrating from AD/AD LDS to a SQL configuration store Changing the Service Account Root container assignment Restricting GPO management for specific domains Configuring role-based delegation

Creating roles Editing roles Delegating roles

Restricting access to objects Adding notifications for users Selecting events on which to be notified Creating email templates Working with Protected Settings policies

Rights and role for Protected Settings for GPOs Create a Protected Settings policy Protecting policy settings based on extensions Generating Protected Settings policies reports Using Protected Settings policies Checking a GPO against a Protected Settings policies and blocked extensions Validating a GPO against a Protected Settings policies and blocked extensions before a check-in

Connecting to the Version Control system

Working with multiple connections

Navigating the GPOADmin console Search folders

Creating custom search folders

Accessing the GPMC extension Configuring user preferences Working with the live environment

Registering objects Registered status Removing registered objects Viewing the live environment

Working with controlled objects (version control root)

Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects

Creating Group Policy Objects (GPOs) Creating starter GPOs Creating WMI filters Creating scripts Creating Desired State Configuration (DSC) PowerShell scripts

Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Managing GPO revisions with lineage Working with registered objects

Creating labels Cloaking a GPO Locking a GPO Establishing Management for an Object Viewing history Deleting version history Clearing account names in version history Viewing and editing object properties Creating a report

Working with available objects

Enabling/disabling workflow Checking out objects Requesting the deletion of an object Requesting approval

Working with checked out objects

Undoing a check out Checking in controlled objects

Working with objects pending approval and deployment

Withdrawing an approval request Enhanced workflow approval Changing the approval workflow Withdrawing approval Approving and rejecting edits Deploying objects (scheduling and associated items)

Checking compliance Editing objects

Removing persistent registry settings

Editing WMI filters Editing scripts Linking GPOs

Synchronizing GPOs

Enabling synchronization Working with GPO synchronizations Generating Synchronized GPO report

Exporting and importing

Export objects Exporting GPO registry settings as a Desired State Configuration resource file Import objects

Creating Reports

Available reports

Controlled object reports

Settings Report Difference Report Group Policy Object Settings Search Report History Report User Activity Report Compliance Report Change Auditor Report Change Auditor Working Copies Report Deployment Report Protected Settings Assignment Report Creating Controlled Object Reports

Diagnostic and troubleshooting reports

Group Policy Object Consistency Report Software Installation Package Report Linked/Unlinked Report Inactive Policy Settings Report Group Policy Object Security Report Policy Analysis Report GPO Synchronization Report Group Policy Results Group Policy Results Difference Report Group Policy Modeling Report Creating Diagnostic and Troubleshooting Reports

Live, working copy, latest version, and differences reports

Creating live, working copy, latest version, and differences reports

Historical Settings Reports

Creating historical settings reports

Exporting registry settings Working with report folders

Managing report folders

Working with the GPOADmin Dashboard

Overview and installation notes Working within the Dashboard

Accessing and configuring the dashboard Connections view Unauthorized Modifications view Checked Out view Pending Approvals view Deployments view

Appendix: Windows PowerShell Commands

Introduction GPOADmin scripts Available commands

GPOADmin PowerShell provider extensions

Using the GPOADmin PowerShell commands (Examples)

Loading the GPOADmin modules Extracting help for GPOADmin commands Managing objects

Get information on all GPOs Get information for all managed objects Get unregistered objects Register an object Check out an object Check in an object Undo the check out of an object Request approval for changes Withdraw an approval request Approve changes Reject changes Withdraw approval on an object Deploy an object Deploy an object at a future time and date Check for pending deployments Cancel pending deployment

Gathering object and GPOADmin information

Identify which objects are checked out Identify which objects are checked out to me What are the properties of an object What objects are available What objects are checked out

Utility commands

Gather GPOADmin license information Install a GPOADmin license Get logging options Set logging options Get notifications Set notifications on objects

Administrative commands

Approval workflow information Set the approval workflow Identify user account s Identify user roles Modify a role Add a role Get an object's security Set an object's security Overwrite a GPOs security filter

Protected Settings commands

Gather Protected Settings information Enable and disable Protected Settings Get a list of Protected Settings Add Protected Settings

Appendix: GPOADmin Event Log

What is the GPOADmin event log? Interpreting the GPOADmin event log

Example GPOADmin events

Appendix: GPOADmin Backup and Recovery Procedures

GPOADmin Backup Requirements Restoring GPOADmin

Appendix: Customizing your workflow

What is a custom workflow action? Working with custom workflow actions in the Version Control system Working with the custom workflow actions xml file

Actions Predefined Tags Conditions Example of a complete pre-action

Troubleshooting custom workflow actions

Appendix: GPOADmin Silent Installation Commands

Installing GPOADmin with msiexec.exe

All components (Complete GPOADmin installation) Client and components

Server and client Client only Client and PowerShell provider (Client Only button on Installation dialog) PowerShell provider only

Watcher Service

Watcher Service on localhost Watcher Service on another computer Watcher Service and GPMC Extension on another computer Watcher Service and Client only on another computer Watcher Service, Client, and GPMC Extension on another computer

GPMC Extension on a localhost GPMC Extension on another computer

GPOADmin Dashboard

Dashboard Service and Client Dashboard Client only Dashboard Service only Client, Dashboard (no service), and GPMC Extension

Viewing and editing object properties

You can easily view and edit the details for the current version of an object in the Version Control system including the security, notification settings, keywords, approvals, lineage, remediation options, as well as the object’s location within version control.

You can also view important information about changes made in the live environment on the Change Auditor tab, if you have a supported version of Change Auditor. See the Release Notes for a complete list of supported versions. You can view changes made to GPOs, domains, and sites on this tab.


	NOTE: Users with the appropriate permission can alter the security settings. For more information, see Configuring role-based delegation .

To view the properties using the GPOADmin console

1

Expand the Version Control Root node, and the required container.

2

Right-click the required object and select Properties.

3

From the Properties dialog box, click the required tab to see the associated information.

Table 10. Options
Option	Description
General	View the domain, user, the creation and modification dates, the version, the unique ID, location in version control, and the GPO status. From here you can also see and, if required, change the user responsible for an object’s management (Managed By property).
Links (From the GPO Properties page)	Edit the link to Scopes of Management. NOTE: You must have the Link permission to add or edit links.
Lineage	Manage GPO revisions by selecting a specific GPO to revert to when a rollback is performed.
Security	Delegate responsibilities over the object.
Approvals	Approval workflows for object creation, deletion, or modification. By default, approvals are processed in the order listed on the Approvals tab in the Container or Item Properties. NOTE: Click the Override inherited work flow check box if you want the approvals process for a container to be different from its top level container.
Notifications	Select the actions to be notified on.
Remediation	Manage which action will occur automatically when an object becomes non-complaint due to an edit or deletion performed outside of GPOADmin.
Keywords	View all the keywords for a given object. For here you can also, add and remove keywords as required. When a new keyword is entered it is saved into a master list of keywords. This master list is displayed for each object. The checkboxes indicate which keywords are applied to each object.
Change Auditor	View changes made to objects in the live environment. You can move the columns and sort by columns. NOTE: You must have a supported version of Change Auditor installed. See the Release Notes for a complete list of supported versions. You can also view and save a report of changes. For information, see Change Auditor Report .

To view the properties using the GPMC Extension

1

Right-click the GPO and select Properties.

2

From the Properties dialog box, click the required tab to see the associated information.

Table 11. Options
Option	Description
General	View the domain, user, the creation and modification dates, the version, the unique ID, location in version control, and the GPO status. From here you can also see and, if required, change the user responsible for an object’s management (Managed By property).
Links (From the GPO Properties page)	Edit the link to Scopes of Management. NOTE: You must have the Link permission to add or edit links.
Lineage	Manage GPO revisions by selecting a specific GPO to revert to when a rollback is performed.
Security	Delegate responsibilities over the object.
Approvals	Number of required approvers for object creation, deletion, or modification.
Notifications	Select the actions to be notified on.
Remediation	Manage which action will occur automatically when an object becomes non-complaint due to an edit or deletion performed outside of GPOADmin.
Keywords	View all the keywords for a given object. For here you can also, add and remove keywords as required. When a new keyword is entered it is saved into a master list of keywords. This master list is displayed for each object. The checkboxes indicate which keywords are applied to each object.
Change Auditor™	View changes made to objects in the live environment. You can move the columns and sort by columns. NOTE: You must have a supported version of Change Auditor installed. See the Release Notes for a complete list of supported versions. NOTE: You can also view and save a report of changes. For information, see Change Auditor Report .

For more information on the available reports, see Creating Reports .

Creating a report

You can create reports that show the details of controlled objects, as well as diagnostic and troubleshooting information. For more information see, Creating Reports .

Working with available objects

With available objects, you can perform all the tasks of registered objects (Show history, view live reports, view properties, unregister, create labels, and import/export), as well as:

•

Enabling/disabling workflow

•

Checking out objects

•

Requesting the deletion of an object

•

Requesting approval


	NOTE: You can view a list of all Available objects in the Search Folders in the GPOADmin console.

Enabling/disabling workflow

If you have the Enable/Disable right, you can enable and disable the workflow for a deployed GPO, Scopes of Management, and WMI filters. The object must be under version control and be a major version (for example, 2.0).

NOTE:

•

To work with and edit workflow disabled GPOs, you must have the GPMC Edit, Delete, and Modify Security right as well as the DeleteSubtree right.

•

You can view a list of Workflow Enabled or Workflow Disabled objects in the Search Folders in the GPOADmin console.

•

If you disable the workflow, any changes made are immediately deployed in the live environment. To bring the object back under version control, enable the workflow.

•

When managing objects across forests, they must be workflow enabled.

•

You can enable and disable workflow on objects through a remote console. However, once they are disabled, they cannot be managed through the remote console.

To enable/disable workflow in the GPOADmin console

1

Expand the Version Control Root node and the required container.

2

Right-click a major version of an available GPO, Scope of Management, or WMI filter and select Disable Workflow.

Right-click a GPO, Scope of Management, or WMI filter that is not workflow enabled and select Enable Workflow.

3

Enter a comment and click OK.

To enable/disable workflow in the GPMC Extension

1

Select a major version of an available GPO, Scope of Management, or WMI filter and click Workflow | Disable Workflow.

Select a GPO, Scope of Management, or WMI filter that is not workflow enabled and click Workflow | Enable Workflow.

2

Enter a comment and click OK.

Related Documents

© 2020 Quest Software Inc. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy