How to manage the policy of PowerShell script domain

How to carry out PowerShell script domain policy management, many novices are not very clear about this, in order to help you solve this problem, the following editor will explain for you in detail, people with this need can come to learn, I hope you can gain something.

In large and medium-sized enterprises, many group policies are set for daily operation and maintenance management, but there are also many abandoned policies that require us to clean up our group policy information on a regular basis. Usually we export HTML reports to help us analyze group policy information:

# 1

First, you need to load the GroupPolicy module:

Import-Module GroupPolicy

Export GPO as a HTML report:

Get-GPOReport-All-ReportType html-Path C:\ GPOReports\ GposReport.html

# 2

Export each GPO to generate its own HTML report:

Get-GPO-All |% {Get-GPOReport-name $_ .displayname-ReportType html-path ("c:\ GPOReports\" + $_ .displayname + ".html")}

# 3

Let's query all GPO policies for which settings are disabled:

$reportFile = "c:\ GPOReports\ AllSettingsDisabledGpos.csv" Set-Content-Path $reportFile-Value ("GPO Name,Settings") Get-GPO-All | where {$_ .GpoStatus-eq "AllSettingsDisabled"} |% {add-Content-Path $reportFile-Value ($_ .displayName + "," + $_ .gpoStatus)}

# 4

The query does not apply to any user's Gpo policy

$reportFile = "c:\ GPOReports\ GPOApplyToPermissions.csv" Set-Content-Path $reportFile-Value ("GPO Name,User/Group,Denied") Get-GPO-All |% {$gpoName = $_ .displayName [int] $counter = 0$ security = $_ .GetSecurityInfo () $security | where {$_ .GetSecurityInfo () "GpoApply"} |% {add-Content-Path $reportFile-Value ($gpoName + "," + $_ .roome.name + ") $counter + = 1} if ($counter-eq 0) {add-Content-Path $reportFile-Value ($gpoName +") NOT APPLIED ")}}

# 4

Get GPO, links, and WMI filters:

$reportFile = "c:\ GPOReports\ GPOLinksAndWMIFilters.csv" Set-Content-Path $reportFile-Value ("GPO Name,# Links,Link Path,Enabled,No Override WMI Filter ") $gpmc = New-Object-ComObject GPMgmt.GPM$constants = $gpmc.GetConstants () Get-GPO-All |% {[int] $counter = 0 [xml] $report = $_ .GenerateReport ($constants.ReportXML) try {$wmiFilterName = $report.gpo.filtername} catch {$wmiFilterName =" none "} $report.GPO.LinksTo |% {if ($_ .SOMPath-ne $null) {$counter + = 1add-Content-Path $reportFile-Value ($report.GPO.Name +", "+ $report.GPO.linksto.Count +", "+ $_ .SOMPath +") "+ $_ .Enabled +", "+ $_ .NoOverride +", "+ $wmiFilterName)} if ($counter-eq 0) {add-Content-Path $reportFile-Value ($report.GPO.Name +", "+ $counter +", "+" NO LINKS "+", "+" NO LINKS "+", "+" NO LINKS ")}}

# 5

The query has organizational units that prevent GPO inheritance:

Import-Module ActiveDirectory$reportFile = "c:\ GPOReports\ OUsWithBlockInharit.csv" set-Content-Path $reportFile-Value ("Block Inharitance OU Path") Get-ADOrganizationalUnit-SearchBase "DC=Your,DC=Domain"-Filter * | Get-GPInheritance | Where-Object {$_ .GPOInheritanceBlocked} |% {add-Content-Path $reportFile-Value ($_ .path)} is it helpful for you to read the above content? If you want to know more about the relevant knowledge or read more related articles, please follow the industry information channel, thank you for your support.