GPO

Script to modify the defaultSecurityDescriptor attribute on the Group-Policy-Container schema class object

June 29, 2016

Last week I published an article about the changes in the behavior of Group Policy processing after the deployment of security update MS16-072 under KB3163622. It included a script to assist with the remediation of Group Policy permissions: Script to report on and remediate the Group Policy security change in MS16-072. Of course that’s not where it […]

Read the full article →

Script to report on and remediate the Group Policy security change in MS16-072

June 22, 2016

On June 14th 2016 Microsoft released security update MS16-072 under KB3163622 that changes the behavior of Group Policy processing so that user group policies are now retrieved by using the machine’s security context instead of the user’s security context. This is a by-design behavior change from Microsoft to protect computers from a security vulnerability. Update 23/06/2016: Microsoft […]

Read the full article →

Script to Create, Import and Export Group Policy WMI Filters

June 9, 2014

This PowerShell script will Create, Import and Export Group Policy WMI Filters. I wrote this script to cover a number of different scenarios: To create a default set of GPO WMI Filters for new builds. To document existing WMI filters for health checks and audits. To provide a mechanism to migrate WMI filters between Dev, […]

Read the full article →

Script to Generate a Group Policy Object (GPO) Version Report

May 23, 2014

Is there a version match between your Group Policy Object (GPO) containers and templates? This PowerShell script will check that the version of each GPO is consistent in the Active Directory Group Policy Container (GPC) and on each Domain Controller in the Group Policy Template (GPT). All Windows Operating Systems (since Windows 2000) will apply the GPO […]

Read the full article →

Script to Create the ADMX Central Store

February 25, 2014

I find it amazing how many Active Directory environments I review that do not have an ADMX Central Store set up. It’s been a best practice since the release of Windows Vista/2008 some 7 years ago now. What I find is that there tends to be ADMX sprawl across management servers and even the workstations […]

Read the full article →

Script to Create Group Policy Objects and WMI Filters to Manage the Time Server Hierarchy

January 10, 2014

This PowerShell script will create the Time Server GPOs and WMI Filters for the Domain Controllers to ensure your time server hierarchy remains correct for transfer and seizure of the PDC emulator FSMO role holder. However, before I talk about the script it’s important to provide some background information on the required settings for the Windows Time […]

Read the full article →

Finding Orphaned Group Policy Objects

September 3, 2012

Group Policy Objects (GPOs) are stored in two parts: GPC (Group Policy Container). The GPC is where the GPO stores all the AD-related configuration under the CN=Policies,CN=System,DC=… container, which is replicated via AD replication. GPT (Group Policy Templates). The GPT is where the GPO stores the actual settings located within SYSVOL area under the Policies folder, which […]

Read the full article →