{"id":54403,"date":"2009-02-12T21:10:00","date_gmt":"2009-02-12T21:10:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2009\/02\/12\/hey-scripting-guy-how-can-i-generate-a-list-of-my-group-policy-objects\/"},"modified":"2009-02-12T21:10:00","modified_gmt":"2009-02-12T21:10:00","slug":"hey-scripting-guy-how-can-i-generate-a-list-of-my-group-policy-objects","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-how-can-i-generate-a-list-of-my-group-policy-objects\/","title":{"rendered":"Hey, Scripting Guy! How Can I Generate a List of My Group Policy Objects?"},"content":{"rendered":"

\"Hey, <\/h2>\n

Hey, Scripting Guy! We have a number of Group Policy Objects (GPOs) that are not really doing anything. In fact, they are about as useless as an old hound dog with sinus problems. What I need is an easy way to find these old GPOs and produce a list so I can decide if I wish to delete them. Can you help me?<\/p>\n

– JG<\/p>\n

\"Spacer\"\"Hey,<\/p>\n

Hi JG,<\/p>\n

“That dog won’t hunt.” I am not sure exactly what that means, but it is the only dog expression I know. I guess because I am living in the Southern part of the United States, I should study Southern speakr more closely. After all they have words down here that are not used in the rest of the United States. Words like haintnarynone<\/i>, which is a reply to the question, “Do you have any more milk?” When you pronounce haintnarynone<\/i> , you say it in one syllable without moving your lips. You can learn this technique by grasping your upper and lower lip between the thumb and the forefinger, and then saying \u201chaintnarynone.\u201d However, I digress. (Let it never be said that a Scripting Guy became distracted during the process of writing a \u201cHey, Scripting Guy!\u201d article. Well, okay, maybe once in a while: A quick search of the Script Center for the word \u201cdistracted\u201d returns eight hits. So 9 times we became distracted. We\u2019ll take that average.) <\/p>\n

Where were we? Oh, yeah. I talked to my neighbor, and he said the kind of dog you want depends on what you are hunting. Oh wait, the dog won’t hunt. Sorry. I don\u2019t really know much about dogs at all, so let’s talk about Group Policy scripting instead.<\/p>\n

var sortedCol = new Array(); var sortFactor = new Array(); var initialSort = new Array(); function rowData(index, value) { this.index = index; this.value = value; } var compareFactor; function compareValues(a, b) { if (a.value b.value) return compareFactor; return 0; } function sortByColumn(tableIndex, tdName, order) { var td = document.getElementById(tdName); var cols = td.parentElement.children; var col = -1; for (var i=0; i < cols.length; i++) if (cols[i] == td) col = i; if (col == -1) return; if (td != sortedCol[tableIndex] && sortedCol[tableIndex] != null) { sortedCol[tableIndex].className = "sortable"; sortedCol[tableIndex].getElementsByTagName("IMG")[0].src="http:\/\/blogs.technet.com\/library\/gallery\/templates\/MNP2.GenericArticle\/..\/MNP2.Common\/images\/sortNone.gif"; } if (td == sortedCol[tableIndex]) { sortFactor[tableIndex] = -sortFactor[tableIndex]; } else { sortedCol[tableIndex] = td; if (!initialSort) sortFactor[tableIndex] = 1; td.className = "selectedSort"; } if (sortFactor[tableIndex] == 1) td.getElementsByTagName("IMG")[0].src="http:\/\/blogs.technet.com\/library\/gallery\/templates\/MNP2.GenericArticle\/..\/MNP2.Common\/images\/sortAscending.gif"; else td.getElementsByTagName("IMG")[0].src="http:\/\/blogs.technet.com\/library\/gallery\/templates\/MNP2.GenericArticle\/..\/MNP2.Common\/images\/sortDescending.gif"; initialSort = false; var thead = td.parentElement.parentElement; var tbody = thead.nextSibling; var table = thead.parentElement; var rows = tbody.getElementsByTagName("TR"); var data = new Array(); var hasEvenRowShading = false; for (var i=0; i < rows.length; i++) if (rows[i].parentElement == tbody) { if (rows[i].className == "evenRecord") hasEvenRowShading = true; var cell = rows[i].children[col]; var value = cell.getAttribute("value"); if (value == null) value = cell.innerText; if (order == 'numerical') { var filterChars = new Array("$", "\u00a2", "\u00a3", "\u00a4", "\u00a5", "₣", "₤", "₧", "₪", "₫", "€", ",", "."); for (var j=0; j < filterChars.length; j++) value = value.replace(filterChars[j], ""); value = parseFloat(value); if (isNaN(value)) value = Number.NEGATIVE_INFINITY; } if (order == 'chronological') value = Date.parse(value); data[i] = new rowData(i, value); } compareFactor = sortFactor[tableIndex]; data = data.sort(compareValues); var tbody2 = document.createElement("TBODY"); for (var i=0; i < data.length; i++) if (data[i]) { var row = rows[data[i].index].cloneNode(true); if ((i % 2 == 0) || !hasEvenRowShading) row.className = "record"; else row.className = "evenRecord"; tbody2.appendChild(row); } table.replaceChild(tbody2, tbody); } <\/p>\n\n<\/thead>\n\n\n
\n

This week is Group Policy week. We will spend the week looking at some of the things you can do using Windows PowerShell when you have access to the COM object that ships with the Group Policy Management Console. There are some good VBScripts that illustrate working with Group Policy in the Script Center Script Repository<\/a>, and in the Community-Submitted Scripts Center<\/a>. You can also download a collection of sample Group Policy management scripts<\/a>.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/div>\n

To find Group Policy objects that do not have any security filtering associated with them, you can use the FindGPOsWithNoSecurityFiltering.ps1<\/b> script which is seen here. To obtain help on the script you can use the following syntax:<\/p>\n

FindGPOsWithNoSecurityFiltering.ps1 \u2013help<\/pre>\n
FindGPOsWithNoSecurityFiltering.ps1<\/b><\/p>\n
param(\n      $domain=$env:userDNSdomain,\n      [switch]$query,\n      [switch]$help,\n      [switch]$examples,\n      [switch]$min,\n      [switch]$full\n      ) #end param\n# Begin Functions\nfunction Get-HelpTopic()\n{\n $descriptionText= `\n@\"\n NAME: FindGPOsWithNoSecurityFiltering.ps1\n DESCRIPTION:\n Finds GPOs that have no security filtering\n assigned, and therefore they apply to no one\n PARAMETERS:\n -domain domain to query for orphaned gpos\n -query causes query to execute\n -help prints help description and parameters file\n -examples prints only help examples of syntax\n -full prints complete help information\n -min prints minimal help. Modifies -help\n\"@ #end descriptionText\n$examplesText= `\n@\"\n SYNTAX:\n FindGPOsWithNoSecurityFiltering.ps1\n Displays an error missing query, and calls help\n FindGPOsWithNoSecurityFiltering.ps1  -query\n Queries current domain for GPOs with no security\n filter applied to them\n FindGPOsWithNoSecurityFiltering.ps1 -domain nwtraders.com -query\n Queries nwtraders.com domain for GPOs with no security\n filter applied to them\n FindGPOsWithNoSecurityFiltering.ps1 -help\n Prints the help topic for the script\n FindGPOsWithNoSecurityFiltering.ps1 -help -full\n Prints full help topic for the script\n FindGPOsWithNoSecurityFiltering.ps1 -help -examples\n Prints only the examples for the script\n FindGPOsWithNoSecurityFiltering.ps1 -examples\n Prints only the examples for the script\n\"@ #end examplesText\n$remarks = `\n\"\nREMARKS\n     For more information, type: $($MyInvocation.ScriptName) -help -full\n\" #end remarks\n  if($examples) { $examplesText ; $remarks ; exit }\n  if($full)     { $descriptionText; $examplesText ; exit }\n  if($min)      { $descriptionText ; exit }\n  $descriptionText; $remarks\n  exit\n} #end Get-HelpTopic function\nfunction New-Line (\n                  $strIN,\n                  $char = \"=\",\n                  $sColor = \"Yellow\",\n                  $uColor = \"darkYellow\",\n                  [switch]$help\n                 )\n{\n if($help)\n  {\n    $local:helpText = `\n@\"\n     New-Line accepts inputs: -strIN for input string and -char for seperator\n     -sColor for the string color, and -uColor for the underline color. Only\n     the -strIn is required. The others have the following default values:\n     -char: =, -sColor: Yellow, -uColor: darkYellow\n     Example:\n     New-Line -strIN \"Hello world\"\n     New-Line -strIn \"Morgen welt\" -char \"-\" -sColor \"blue\" -uColor \"yellow\"\n     New-Line -help\n\"@\n   $local:helpText\n   break\n  } #end New-Line help\n $strLine= $char * $strIn.length\n Write-Host -ForegroundColor $sColor $strIN\n Write-Host -ForegroundColor $uColor $strLine\n} #end New-Line function\nFunction Get-NoFilter()\n{\n $gpm = new-object -comobject gpmGMT.gpm\n $constants = $gpm.getConstants()\n $gpmDomain = $gpm.GetDomain($domain,$null,$constants.useanydc)\n $gpmSearchCriteria = $gpm.CreateSearchCriteria()\n $gpoList = $gpmDomain.SearchGpos($gpmSearchCriteria)\n $perm = $Constants.PermGPOApply\n foreach($gpo in $gpoList)\n  {\n   $secInfo = $gpo.GetSecurityInfo()\n    foreach($secPerm in $secInfo)\n     {\n      if($secPerm.Permission -ne $perm)\n         {\n           $errorActionPreference = \"SilentlyContinue\"\n           $hash += @{ $gpo.id = $gpo.DisplayName }\n           $errorActionPreference = \"continue\"\n         } #end if\n     } #end foreach\n  } #end foreach\n  New-Line(\"No permissions were found $($hash.count) GPOs\")\n  format-table -inputobject $hash -autosize\n exit\n} #end Get-NoFilter\n# Entry Point\nif($help)      { Get-HelpTopic }\nif($examples)  { Get-HelpTopic }\nif($full)      { Get-HelpTopic }\nif($query)    { Get-NoFilter }\nif(!$query) { \"missing query .. \" ; Get-HelpTopic }\n<\/pre>\n
 <\/p>\n
The FindGPOsWithNoSecurityFiltering.ps1<\/b> script is written in the same style as the other GPO scripts we have seen this week. Please refer to the articles from Monday<\/a> and Tuesday<\/a> to see information about the command-line parameters, the help function, and the New-Line<\/b> function.<\/p>\n
The core script functionality is the Get-NoFilter<\/b> function, which is used to find GPOs that have no security filter applied. The first thing we do in the function is to create an instance of the gpmGMT.gpm<\/b> object. Because the object is a COM object we use the \u2013comobject<\/b> parameter of the New-Object <\/b>cmdlet. We store the returned object in the $gpm<\/b> variable as seen here:<\/p>\n
$gpm = new-object -comobject gpmGMT.gpm<\/pre>\n
After we have created the gpmGMT.gpm<\/b> object, we have access to the methods seen in Table 1.<\/p>\n
        var tableId = “EFF”;        sortedCol[tableId] = null;        sortFactor[tableId] = 1;        initialSort[tableId] = true;      <\/p>\n\n\n\n\n
Table 1 Methods of the GpmGMT.gpm object<\/td>\n<\/tr>\n
<\/p>\n\n\n\n
Name<\/td>\n\"*\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/a><\/td>\n
<\/p>\n\n\n\n
MemberType<\/td>\n\"*\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/a><\/td>\n
<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Definition<\/td>\n\"*\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/a><\/td>\n<\/tr>\n<\/thead>\n
\n
CreateMigrationTable<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMMigrationTable CreateMigrationTable ()<\/p>\n<\/td>\n<\/tr>\n
\n
CreatePermission<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMPermission CreatePermission (string, GPMPermissionType, bool)<\/p>\n<\/td>\n<\/tr>\n
\n
CreateSearchCriteria<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMSearchCriteria CreateSearchCriteria ()<\/p>\n<\/td>\n<\/tr>\n
\n
CreateTrustee<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMTrustee CreateTrustee (string)<\/p>\n<\/td>\n<\/tr>\n
\n
GetBackupDir<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMBackupDir GetBackupDir (string)<\/p>\n<\/td>\n<\/tr>\n
\n
GetBackupDirEx<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMBackupDirEx GetBackupDirEx (string, GPMBackupType)<\/p>\n<\/td>\n<\/tr>\n
\n
GetClientSideExtensions<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMCSECollection GetClientSideExtensions ()<\/p>\n<\/td>\n<\/tr>\n
\n
GetConstants<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMConstants GetConstants ()<\/p>\n<\/td>\n<\/tr>\n
\n
GetDomain<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMDomain GetDomain (string, string, int)<\/p>\n<\/td>\n<\/tr>\n
\n
GetMigrationTable<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMMigrationTable GetMigrationTable (string)<\/p>\n<\/td>\n<\/tr>\n
\n
GetRSOP<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMRSOP GetRSOP (GPMRSOPMode, string, int)<\/p>\n<\/td>\n<\/tr>\n
\n
GetSitesContainer<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
IGPMSitesContainer GetSitesContainer (string, string, string, int)<\/p>\n<\/td>\n<\/tr>\n
\n
InitializeReporting<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
void InitializeReporting (string)<\/p>\n<\/td>\n<\/tr>\n
\n
InitializeReporting<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
void InitializeReportingEx (string, int)<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/div>\n
The next thing we need to do is to create the constants and to store them in a variable. We talked about Group Policy constants in Wednesday\u2019s \u201cHey, Scripting Guy!\u201d article<\/a>, and the process and purpose is exactly the same as what we do here:<\/p>\n
$constants = $gpm.getConstants()<\/pre>\n
Now we need to connect to the domain. To do that, we use the GetDomain<\/b> method and pass it the name of the domain and the useanydc<\/b> constant. We store the returned object in the $gpmDomain<\/b> variable. Next we need to create the search criteria. To do this, we use the CreateSearchCriteria<\/b> method and store the returned search criteria in the $gpmSearchCriteria<\/b> variable. We then use the SearchGpos<\/b> method from the domain we stored in the $gpmDomain<\/b> variable. We give the SearchGpos<\/b> method the search criteria we created in the previous line. This is seen here:<\/p>\n
$gpmDomain = $gpm.GetDomain($domain,$null,$constants.useanydc)\n$gpmSearchCriteria = $gpm.CreateSearchCriteria()\n$gpoList = $gpmDomain.SearchGpos($gpmSearchCriteria)\n<\/pre>\n
We now need to retrieve a specific constant from all the constants we have stored in the $constants<\/b> variable. The specific one we need is called PermGPOApply<\/b>, and it is used to specify that the GPO has permissions applied. This is seen here, where we store the resultant constant in the $perm<\/b> variable:<\/p>\n
$perm = $Constants.PermGPOApply\n<\/pre>\n
We are now ready to begin examining each of the GPOs. We first use the ForEach<\/b> statement to work through each of the GPOs that is stored in the $gpoList<\/b> variable. We take each one of the GPOs and call the GetSecurityInfo<\/b> method to retrieve the security information that is associated with each of the GPOs. We store the security information in the $secInfo <\/b>variable: <\/p>\n
foreach($gpo in $gpoList)\n  {\n   $secInfo = $gpo.GetSecurityInfo()\n<\/pre>\n
When we have the security information, we need to examine each permission that makes up the security information attached to the GPO. If the permission is not equal to the PermGPOApply<\/b> constant, we add the name of the GPO to the hash table we create with the name of $hash<\/b>. A hash table is similar to the VBScript concept of a dictionary object<\/a>. Before and after each attempt to obtain the display name, we use $errorActionPreference = “SilentlyContinue”<\/b>, which is the same as VBScript On Error Resume Next<\/a>. By setting $errorActionPreference<\/b> equal to “continue”, in this case it is similar to using On Error Goto 0<\/b>, which is discussed here<\/a>.<\/p>\n
foreach($secPerm in $secInfo)\n     {\n      if($secPerm.Permission -ne $perm)\n         {\n           $errorActionPreference = \"SilentlyContinue\"\n           $hash += @{ $gpo.id = $gpo.DisplayName }\n           $errorActionPreference = \"continue\"\n         } #end if\n     } #end foreach\n  } #end foreach\n<\/pre>\n
It is time to produce our report. We use the count<\/b> property from the hashtable<\/b> object to tell us how many GPOs were found without permissions. We then call the Format-Table<\/b> cmdlet to print out the hash table:<\/p>\n
New-Line(\"No permissions were found $($hash.count) GPOs\")\n  format-table -inputobject $hash \u2013autosize\n<\/pre>\n
 <\/p>\n
Well, JG, I believe that “this dog will<\/i> hunt!” This concludes our Group Policy scripts. The next time we write about Group Policy, Windows 2008 R2 will be out and the scripts will be much cleaner as we will also take advantage of the help features of Windows PowerShell 2.0. If you can’t wait, go ahead and download Windows 2008 R2 and start playing around with it. I am running it on one of my laptops with Hyper-V and it rocks! Join us tomorrow for Quick-Hits Friday where we will tackle a grab bag<\/a> of questions. Until then, peace.<\/p>\n
 <\/p>\n
Ed Wilson and Craig Liebendorfer, Scripting Guys<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! We have a number of Group Policy Objects (GPOs) that are not really doing anything. In fact, they are about as useless as an old hound dog with sinus problems. What I need is an easy way to find these old GPOs and produce a list so I can decide if I […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[152,3,45],"class_list":["post-54403","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-group-policy","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! We have a number of Group Policy Objects (GPOs) that are not really doing anything. In fact, they are about as useless as an old hound dog with sinus problems. What I need is an easy way to find these old GPOs and produce a list so I can decide if I […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=54403"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54403\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=54403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=54403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=54403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}