Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

GPOADmin 5.19 - User Guide

Table of Contents

Introducing Quest GPOADmin

GPOADmin features

Client/server architecture Multiforest support Group Policy Management Console extension Version control Change approval process Role-based delegation Notification system GPO ACL editor Reporting options Customized views Offline GPO testing Custom workflow actions

Configuring GPOADmin

Configuring the Version Control server Setting permissions on AD LDS Setting permissions when using SQL as the configuration store Port requirements Editing the Version Control server properties Editing the Version Control server configuration store Replacing the Version Control server configuration settings Migrating from AD/AD LDS to a SQL configuration store Changing the Service Account Root container assignment Restricting GPO management for specific domains Configuring role-based delegation

Creating roles Editing roles Delegating roles

Restricting access to objects Adding notifications for users Selecting events on which to be notified Restricting inheritance on notifications Creating email templates Working with Protected Settings policies

Rights and role for Protected Settings for GPOs Create a Protected Settings policy Protecting policy settings based on extensions Generating Protected Settings policies reports Using Protected Settings policies Checking a GPO against a Protected Settings policies and blocked extensions Validating a GPO against a Protected Settings policies and blocked extensions before a check-in

Working with Protected Settings Policy Baselines

Connecting to the Version Control system

Restricting search scope Working with multiple connections Version Control data in the directory

Navigating the GPOADmin console Search folders

Creating custom search folders

Accessing the GPMC extension Configuring user preferences Working with the live environment

Registering objects Registered status Removing registered objects Viewing the live environment

Working with controlled objects (version control root)

Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects

Creating Group Policy Objects (GPOs) Creating starter GPOs Creating WMI filters Creating scripts Creating Desired State Configuration (DSC) PowerShell scripts

Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects

Creating labels Cloaking a GPO Locking a GPO Establishing Management for an Object Viewing history Deleting version history Clearing account names in version history Viewing and editing object properties Applying keywords on containers Creating a report

Working with available objects

Enabling/disabling workflow Checking out objects Requesting the deletion of an object Unregistering GPOs and removing history Requesting approval

Working with checked out objects

Undoing a check out Checking in controlled objects

Working with objects pending approval and deployment

Withdrawing an approval request Enhanced workflow approval Changing the approval workflow Withdrawing approval Approving and rejecting edits Deploying objects (scheduling and associated items)

Checking compliance Editing objects

Removing persistent registry settings

Editing Intune objects (Configuration profiles and Compliance policies) Editing WMI filters Editing scripts Linking GPOs

Synchronizing GPOs

Enabling synchronization Working with GPO synchronizations Generating Synchronized GPO report

Exporting and importing

Export objects Exporting GPO registry settings as a Desired State Configuration resource file Import objects

Creating Reports

Available reports

Controlled object reports

Settings Report Difference Report Group Policy Comparison Report History Report Group Policy Object Settings Search Report User Activity Report Role Assignment Report All Actions Report Compliance Report Change Auditor Report Change Auditor Working Copies Report Deployment Report Protected Settings Assignment Report Attestation Report Creating Controlled Object Reports

Diagnostic and troubleshooting reports

Group Policy Object Consistency Report Software Installation Package Report Linked/Unlinked Report Linked/Unlinked SOMs Report Inactive Policy Settings Report Group Policy Object Security Report Group Policy Permission Check Report Group Policy Size Validation Report Policy Analysis Report GPO Synchronization Report Group Policy Results Group Policy Results Difference Report Group Policy Modeling Report Group Policy Object Settings Priority Report Creating Diagnostic and Troubleshooting Reports

Live, working copy, latest version, and differences reports

Creating live, working copy, latest version, and differences reports

Historical Settings Reports

Creating historical settings reports

Creating RSoP validation reports Exporting registry settings Working with report folders

Managing report folders

Appendix: Windows PowerShell Commands

Introduction GPOADmin scripts Available commands

GPOADmin PowerShell provider extensions

Using the GPOADmin PowerShell commands (Examples)

Loading the GPOADmin modules Extracting help for GPOADmin commands Managing objects

Get information on all GPOs Get information for all managed objects Get unregistered objects Register an object Check out an object Check in an object Undo the check out of an object Request approval for changes Withdraw an approval request Approve changes Reject changes Withdraw approval on an object Deploy an object Deploy an object at a future time and date Check for pending deployments Cancel pending deployment

Gathering object and GPOADmin information

Identify which objects are checked out Identify which objects are checked out to me What are the properties of an object What objects are available What objects are checked out

Utility commands

Gather GPOADmin license information Install a GPOADmin license Get logging options Set logging options Get notifications Set notifications on objects

Administrative commands

Approval workflow information Set the approval workflow Identify user accounts Identify user roles Modify a role Add a role Get an object's security Set an object's security Overwrite a GPOs security filter

Protected Settings commands

Gather Protected Settings information Enable and disable Protected Settings Get a list of Protected Settings Add Protected Settings

Appendix: GPOADmin Event Log

What is the GPOADmin event log? Interpreting the GPOADmin event log

Example GPOADmin events

Appendix: GPOADmin Backup and Recovery Procedures

GPOADmin Backup Requirements Restoring GPOADmin

Appendix: Customizing your workflow

What is a custom workflow action? Working with custom workflow actions in the Version Control system Working with the custom workflow actions xml file

Actions Predefined Tags Conditions Example of a complete pre-action

Troubleshooting custom workflow actions

Appendix: GPOADmin Silent Installation Commands

Installing GPOADmin with msiexec.exe

All components (Complete GPOADmin installation) Client and components

Server and client Client only Client and PowerShell provider (Client Only button on Installation dialog) PowerShell provider only

Watcher Service

Watcher Service on localhost Watcher Service on another computer Watcher Service and GPMC Extension on another computer Watcher Service and Client only on another computer Watcher Service, Client, and GPMC Extension on another computer

GPMC Extension on a localhost GPMC Extension on another computer

Appendix: Configuring Gmail for Notifications

Using Gmail for Workflow Approvals Creating a Gmail Credentials File

Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Event ID types

The Event IDs generated by GPOADmin are broken into the following types:


Event ID	Description
0	Associated with the GPOADmin Server Service
1000	Request
1001	Deploy
1002	Approve
1003	Reject
1004	Create
1005	Check Out
1006	Check In
1007	Move
1008	Undo check out
1009	Register
1010	Unregister
1011	Modify Security
1012	Withdraw Approval
1013	Withdraw Approval Request
1014	Compliance Action
1015	Create Container
1016	Delete Container
1017	Edit Container
1018	Modify Container Security
1019	Disable Workflow
1020	Enable Workflow
1050	The Watcher Service
1100	Email Message: "SMTP Host is undefined"
1150	Email Message: Exceptions
2001	Error importing settings to object
2002	Various generic exception messages
2004	Various generic exception messages
2005	Various generic exception messages
2006	Various generic exception messages
2007	Various generic exception messages
2010	Problem with Access Control List (ACL) attribute.
2013	GPOADmin server process – Information
2014	GPOADmin server process – Errors
2015	Custom Workflow Action process – Standard Output stream
2016	Custom Workflow Actions process – Error stream
2245	Problem with Read Only domains or a problem with the version control containers.
3060	Connect to and disconnect from GPOADmin.
5000	Problem with the license – error code and error message
5000-2086928381	Invalid license – wrong product
5000-2086928382	Invalid license – demo expired
5000-2086928383	Invalid license – license expired
5000-2147467259	Invalid license
6010	Collector initialization
6015	Polling interval set
6040	Failed to load configuration file
6045	Problem loading configuration file
6046	Configuration file corrupt
6047	Configuration file missing
6050	Error adding items to collection
6060	Configuration file deleted
6065	Configuration file renamed
6066	Configuration file name restored
6070	Configuration file restored
6100	Error during search
6101	Error during collection of object for GPO Statistics
6102	Error during parsing of objects for GPO Statistics

Example GPOADmin events

The following table illustrates how events display in your log.

Table 22. Log Events
LEVEL	SOURCE	EVENT ID	TASK CATEGORY	DESCRIPTION
Information	GPOADmin	1050	2	The change is an authorized change made by GPOADmin on a working copy.
Warning	GPOADmin	1050	2	Unable to locate any domain controllers to monitor.

Appendix: GPOADmin Backup and Recovery Procedures

•

GPOADmin Backup Requirements

•

Restoring GPOADmin

GPOADmin Backup Requirements

As part of your normal disaster procedures or requirements, GPOADmin should be considered for inclusion. In the event of a computer or network failure, the GPOADmin deployment and its data can be restored if you have performed regular and distributed backups of the following:

•

The GPOADmin configuration store.

•

The GPO backups store.

During the initial installation of GPOADmin, you must specify where to place these two items within your environment. The configuration store can reside in either Active Directory or AD LDS. The GPO backup store can be in Active Directory, AD LDS, a network share, or on a SQL server. The recommended location is on a network share.

Each of these options has its own backup strategies and requirements and should be included in your regular backup schedule.


	NOTE: While GPOADmin is inaccessible, you can manage GPOs through the Group Policy Management Console (GPMC).

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center