• 成为门户专家
• 下载
• 打印
• 我的下载 ()

• 支持
• 技术说明文件
• GPOADmin 5.18
• GPOADmin 5.18 - User Guide

GPOADmin 5.18 - User Guide

内容导航  

Introducing Quest GPOADmin

GPOADmin features

Client/server architecture Multiforest support Group Policy Management Console extension Version control Change approval process Role-based delegation Notification system GPO ACL editor Reporting options Customized views Offline GPO testing Custom workflow actions

Configuring GPOADmin

Configuring the Version Control server Setting permissions on AD LDS Setting permissions when using SQL as the configuration store Port requirements Editing the Version Control server properties Editing the Version Control server configuration store Replacing the Version Control server configuration settings Migrating from AD/AD LDS to a SQL configuration store Changing the Service Account Root container assignment Restricting GPO management for specific domains Configuring role-based delegation

Creating roles Editing roles Delegating roles

Restricting access to objects Adding notifications for users Selecting events on which to be notified Restricting inheritance on notifications Creating email templates Working with Protected Settings policies

Rights and role for Protected Settings for GPOs Create a Protected Settings policy Protecting policy settings based on extensions Generating Protected Settings policies reports Using Protected Settings policies Checking a GPO against a Protected Settings policies and blocked extensions Validating a GPO against a Protected Settings policies and blocked extensions before a check-in

Using GPOADmin

Connecting to the Version Control system

Restricting search scope Working with multiple connections Version Control data in the directory

Navigating the GPOADmin console Search folders

Creating custom search folders

Accessing the GPMC extension Configuring user preferences Working with the live environment

Registering objects Registered status Removing registered objects Viewing the live environment

Working with controlled objects (version control root)

Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects

Creating Group Policy Objects (GPOs) Creating starter GPOs Creating WMI filters Creating scripts Creating Desired State Configuration (DSC) PowerShell scripts

Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects

Creating labels Cloaking a GPO Locking a GPO Establishing Management for an Object Viewing history Deleting version history Clearing account names in version history Viewing and editing object properties Applying keywords on containers Creating a report

Working with available objects

Enabling/disabling workflow Checking out objects Requesting the deletion of an object Unregistering GPOs and removing history Requesting approval

Working with checked out objects

Undoing a check out Checking in controlled objects

Working with objects pending approval and deployment

Withdrawing an approval request Enhanced workflow approval Changing the approval workflow Withdrawing approval Approving and rejecting edits Deploying objects (scheduling and associated items)

Checking compliance Editing objects

Editing GPOs

Removing persistent registry settings

Editing Intune objects (configuration profiles and compliance policies) Editing WMI filters Editing scripts Linking GPOs

Synchronizing GPOs

Enabling synchronization Working with GPO synchronizations Generating Synchronized GPO report

Exporting and importing

Export objects Exporting GPO registry settings as a Desired State Configuration resource file Import objects

Creating Reports

Available reports

Controlled object reports

Settings Report Difference Report Group Policy Comparison Report History Report Group Policy Object Settings Search Report User Activity Report Role Assignment Report All Actions Report Compliance Report Change Auditor Report Change Auditor Working Copies Report Deployment Report Protected Settings Assignment Report Attestation Report Creating Controlled Object Reports

Diagnostic and troubleshooting reports

Group Policy Object Consistency Report Software Installation Package Report Linked/Unlinked Report Linked/Unlinked SOMs Report Inactive Policy Settings Report Group Policy Object Security Report Group Policy Permission Check Report Group Policy Size Validation Report Policy Analysis Report GPO Synchronization Report Group Policy Results Group Policy Results Difference Report Group Policy Modeling Report Creating Diagnostic and Troubleshooting Reports

Live, working copy, latest version, and differences reports

Creating live, working copy, latest version, and differences reports

Historical Settings Reports

Creating historical settings reports

Creating RSoP validation reports Exporting registry settings Working with report folders

Managing report folders

Appendix: Windows PowerShell Commands

Introduction GPOADmin scripts Available commands

GPOADmin PowerShell provider extensions

Using the GPOADmin PowerShell commands (Examples)

Loading the GPOADmin modules Extracting help for GPOADmin commands Managing objects

Get information on all GPOs Get information for all managed objects Get unregistered objects Register an object Check out an object Check in an object Undo the check out of an object Request approval for changes Withdraw an approval request Approve changes Reject changes Withdraw approval on an object Deploy an object Deploy an object at a future time and date Check for pending deployments Cancel pending deployment

Gathering object and GPOADmin information

Identify which objects are checked out Identify which objects are checked out to me What are the properties of an object What objects are available What objects are checked out

Utility commands

Gather GPOADmin license information Install a GPOADmin license Get logging options Set logging options Get notifications Set notifications on objects

Administrative commands

Approval workflow information Set the approval workflow Identify user accounts Identify user roles Modify a role Add a role Get an object's security Set an object's security Overwrite a GPOs security filter

Protected Settings commands

Gather Protected Settings information Enable and disable Protected Settings Get a list of Protected Settings Add Protected Settings

Appendix: GPOADmin Event Log

What is the GPOADmin event log? Interpreting the GPOADmin event log

Event ID types

Example GPOADmin events

Appendix: GPOADmin Backup and Recovery Procedures

GPOADmin Backup Requirements Restoring GPOADmin

Appendix: Customizing your workflow

What is a custom workflow action? Working with custom workflow actions in the Version Control system Working with the custom workflow actions xml file

Actions Predefined Tags Conditions Example of a complete pre-action

Troubleshooting custom workflow actions

Appendix: GPOADmin Silent Installation Commands

Installing GPOADmin with msiexec.exe

All components (Complete GPOADmin installation) Client and components

Server and client Client only Client and PowerShell provider (Client Only button on Installation dialog) PowerShell provider only

Watcher Service

Watcher Service on localhost Watcher Service on another computer Watcher Service and GPMC Extension on another computer Watcher Service and Client only on another computer Watcher Service, Client, and GPMC Extension on another computer

GPMC Extension

GPMC Extension on a localhost GPMC Extension on another computer

Appendix: Configuring Gmail for Notifications

Using Gmail for Workflow Approvals Creating a Gmail Credentials File

Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

• Viewing Topics 229 - 232 of 255

×

Predefined Tags

Tags are typically replaced with their corresponding values by the service. However, there are cases where the tags will not be converted. For example, if a comment is not specified during the version control action then the [COMMENT] tag will be empty; or if the object is not checked out then the [TRUSTEENAME] and [TRUSTEESID] will be empty.

Keep in mind that in some cases the tags will always be empty as is the case of a pre-action for the Register version control action. At the time the pre-action is processed, the corresponding version control information would not exist.

NOTE: Tags must be uppercase and enclosed in square brackets.

Parameters and conditions support the following predefined tags:

Table 25. Available tags

Tag	Description
[ACTION]	The currently executing version control action.
[VCID]	The version control identifier of the current object.
[DOMAINNAME]	The name of the domain for the current object.
[FULLPATH]	The full path of the current object in the version control system.
[ID]	The identifier for the current object.
[LASTBACKUPID]	The identifier of the last backup for the current object.
[NAME]	The name of the current object.
[STATUS]	The version control status for the current object. See Status values for more information.
[SUBSTATUS]	The version control sub status for the current object.See Sub status values for more information.
[TRUSTEENAME]	The name of the user the current object is checked out to.
[TRUSTEESID]	The SID of the user the current object is checked out to.
[TYPE]	The version control type of the current object.
[VERSION]	The version of the current object.
[COMMENT]	The comment associated with the version control action.

Sub status values

The possible values of a registered object's sub status include the following:

Table 26. Substatus values

Value	Description
None	Default.
Register	Registers objects with the version control system.
Unregister	Unregisters objects from the version control system.
CheckIn	Save edits made to an object in the version control system.
CheckOut	Prepares an object in the version control system for editing.
UndoCheckOut	Discards change made to an object in the version control system.
RollBack	Restores an object in the version control system to a previous known state.
Restore	Restores an object in the version control system to a previous known state.
Get	Overwrites the current settings of an object in the version control system with settings from a previous known sate.
Import	Overwrites the current settings of an object in the version control system with settings from a previous backup.
IncorporateLive	Overwrites the current settings of an object in the version control system with those from the live environment.
Create	Creates a new object in the version control system.
Branch	Branch on object.
Edit	Edits an object in the version control system.
Delete	Marks an object in the version control system as deleted.
Approve	Approves changes made to an object in the version control system.
Reject	Rejects changes made to an object in the version control system.
RequestApproval	Request approval for changes made to an object in the version control system.
ApplyPolicyTemplate	Applies a template to a policy in the version control system.
Label	Labels objects in the version control system.
Lock	Locks an object in the version control system.
Unlock	Unlocks an object in the version control system.
Cloak	Cloaks an object in the version control system.
Uncloak	Uncloaks an object in the version control system.
EnableWorkflow	Forces the object to follow version control workflow.
DisableWorkflow	Allows the object to not follow version control workflow.
Move	Moves an object from one container to another in the version control system.
WithdrawApproval	Withdraws approval of changes for an object in the version control system.
WithdrawApprovalRequest	Withdraws an approval request for changes to an object in the version control system.
Rename	Renames an object in the version control system.
SubmitScheduledApproval	Submits approval for scheduled deployment of an object in the version control system.
CancelScheduledApproval	Cancels a scheduled deployment of an object in the version control system.
Deploy	Deploys an object in the version control system to the live environment.
Link	Links a policy object to a scope of management in the version control system.
LinkUpdate	Updates the links on a scope of management.
ComplianceAction	An action which affects the compliance of an object in the version control system.
ModifySecurity	Modifies the security of an object in the version control system.
UnauthorizedModifications	A backup of a noncompliant object. This is intended to be done by the Watcher Service.
MigrationAction	Indicates an import from NetPro GPOADmin. This is intended to be done by the Migration Wizard.
Synchronization	Synchronizes a source object to one or more targets of the same type.
ToggleApprovalWorkflow	Toggles the order of approval workflow processing.
FailedDeployment	A deployment has failed.

Status values

The possible values of a version controlled object’s status include the following:

Table 27.  

Status Value	Description
Unregistered	The object is unregistered.
Available	The version controlled object is available.
CheckedOut	The version controlled object is checked out.
Pending	The version controlled object is in a pending state. Check the substatus for more information.
PendingDeployment	The version controlled object is pending deployment.
Deleted	The version controlled object is flagged as deleted.
Error	The version controlled object is in error.
ErrorNoWorkingCopy	The version controlled object does not have an associated working copy.
Cloaked	The version controlled object is cloaked
Locked	The version controlled object is locked.
Noncompliant	The version controlled object is noncompliant.
Noncompliant_Deleted	The version controlled object is noncompliant because it was deleted.
Noncompliant_Moved	The version controlled object is noncompliant because it was moved.
Moved	The version controlled object has been moved. This status only applies to OUs.
Unknown	The version controlled objects status is unknown.

Conditions

Whether or not an action is processed can be controlled by the use of conditions. A condition must evaluate to true in order for the action to be processed. If the condition evaluates to false then a log entry stating such is created and the current custom workflow action is not processed.

Each condition node has the following properties:

Table 28. Condition properties

Property	Description
DataType	The data type of the property being compared.
Value1	The left side of the comparison.
Value2	The right side of the comparison.
Operator	The operation to perform. Options depend on the DataType.
IgnoreCase	This is only valid for the string DataType. This property instructs the service to perform any string operations case insensitively.

The type of operations available depends on the DataType property.

The following DataTypes are available:

Table 29. DataTypes

DataType	Description
String	This condition is performed on a string.
Guid	This condition is performed on a Guid.
Version	The condition is performed on a version.

The following operations are available for a String DataType:

Table 30.  

String operator	Description
equal	Determines whether or not Value1 and Value2 have the same value.
not equal	Determines whether or not Value1 and Value2 are different.
contains	Determines whether or not Value2 is present in Value1
not contains	Determines whether or not Value2 is missing from Value1.
starts with	Determines whether or not Value1 starts with Value2.
not starts with	Determines whether or not Value1 does not start with Value2.
ends with	Determines whether or not Value1 ends with Value2.
not ends with	Determines whether or not Value1 does not end with Value2.

The following operations are available for a Guid DataType:

Table 31. Guid operators

Guid operator	Description
equal	Determines whether or not Value1 and Value2 have the same value.
not equal	Determines whether or not Value1 and Value2 are different.

The following operations are available for a Version DataType:

Table 32. Version operators

Version operator	Description
equal	Determines whether or not Value1 and Value2 have the same value.
not equal	Determines whether or not Value1 and Value2 are different.
greater than	Determines whether or not Value1 is greater than Value2.
greater than or equals	Determines whether or not Value1 is greater than or equal to Value2.
less than	Determines whether or not Value1 is lesser than Value2.
less than or equals	Determines whether or not Value1 is lesser than or equal to Value2.

The available logical operators include:

Table 33. Operators

Operator	Description
And	Logically ANDs to conditions.
Or	Logically ORs to conditions.

The logical operators ‘And’ and ‘Or’ function sequentially and grouping is not supported. For example:

Condition1 And Condition2 Or Condition3

would be processed as:

(Condition1 And Condition2) Or Condition3

not as:

Condition1 And (Condition2 Or Condition3)

To use a logical “And” or “Or” operator, specify a new Condition with only the Operator property.

For example:

<Condition Operator="And"/>

<Condition Operator="Or"/>

Example of a complete pre-action

The following example demonstrates a pre-action that creates a CheckIn directory below the GPOSettingsReports directory provided that the name of the version controlled object contains an underscore and the version is less than 4.5 or the comment ends with “_AMER”.

 

<?xml version="1.0" encoding="utf-8"?>

<CustomWorkflowActions>

<CheckIn>

<PreActions>

<Action Name="CheckIn pre-action" Comment="A custom action." StopOnError="false">

<Executable>c:\windows\system32\cmd.exe</Executable>

<Parameters>/C mkdir "c:\GPOSettingsReports\CheckIn"</Parameters>

<Conditions>

<Condition DataType="String" Value1="[NAME]" Operator="contains" Value2="_" IgnoreCase='true'/>

<Condition Operator="And"/>

<Condition DataType="Version" Value1="[VERSION]" Operator="less than" Value2="4.5"/>

<Condition Operator="Or"/>

<Condition DataType="String" Value1="[COMMENT]" Operator="ends with" Value2="_AMER"/>

</Conditions>

</Action>

</PreActions>

<PostActions>

</PostActions>

</CheckIn>

</CustomWorkflowActions>

Troubleshooting custom workflow actions

Because custom workflow actions are performed in the background by the GPOADmin service, they will not be visible from the interface. However, you can use the logs to assess any issues. When a custom workflow action is processed, the Standard Output and Error streams are redirected and logged as part of the server actions provided the Debug logging option is enabled.

NOTE: Depending on the custom workflow action, there can be a large amount of data written to the logs. It is strongly recommended that all custom workflow actions be thoroughly tested by a user who has access to the GPOADmin server logs.

 

Table 34. Event IDs and corresponding source

Event ID	Source
2013	GPOADmin server process – Information
2014	GPOADmin server process – Errors
2015	Custom Workflow Action process – Standard Output stream
2016	Custom Workflow Actions process – Error stream

 

 

•  上一页
• Viewing Topics 229 - 232 of 255
• 下一页 

搜索该文档 在所有文档中搜索该产品版本 在所有文档中搜索该产品 搜索所有文档

×

 欢迎访问支持

您可以在附属支持站点上查找适用于戴尔*产品*的在线支持帮助。单击“继续”，转至适用于*产品*的正确支持内容和帮助。

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级

© 2024 Quest Software Inc. ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center