Group Policy Processing Order

Group Policy - Sysvol Permissions for one ore more GPO's on this domain controller are not in sync with the permissions for the GPOs on the Baseline domain controller

 

Group Policy Error - "The Permissions for this GPO in Sysvol folder are Inconsistent with those in Active Directory"

 

Group Policy - Processing of Multiple GPOs linked on Same OU

 

Group Policy Preferences - Apply once and do not reapply Setting

 

Group Policy - Domain Group Policy Overrides the Local Group Policy

 

Group Policy Preference Items - Stop Processing Items in this extension if an error occurs

 

Group Policy - Denying applying Policy for set of users.

Group Policy - Applying GPO only on DC holding PDC Emulator

Group Policy - Interactive logon: Display user information when the session is locked

 

Group Policy - Displaying a Custom Message before Server login

Group Policy - Accounts: Rename administrator account

Group Policy - Interactive log on: Prompt the user to change passwords before expiration

 

Group Policy - Security Concern in Security GPO

 

Fix - Software Installation via GPO Error code %%1274

GPO - The Interactive logon: Number of previous logons to cache (in case domain controller is not available)

Difference in Gpupdate vs Gpupdate Force

 

Powershell Script - Exporting GPO Settings in HTML

<#Read Me

Script Usage - Backing/Exporting GPO settings into HTML format.

Script Workflow

1. We can either use a ".txt" file as an Input file containing GPO's which we want to export.

2. Incase, we want to export all the GPO's in the domain, then use "Get-GPO" cmdlet with -All switch.

3. Outputs will be created in GPOname.html 

******************************************************************************#>

#Script 1 - Exporting all the GPO's in the domain.

$gpo = Get-GPO -All

foreach($item in $gpo)

{

$gponame = $item.DisplayName

Get-GPOReport -Name $gponame -ReportType HTML | Out-File ./$gponame.html

}

#Script 2 - Exporting all the GPO's mentioned in 'InputGPOdetails.txt' file.

#Note - Have this file under same folder where Script is kept.

$InputGPOdetails = Get-Content ./InputGPOdetails.txt

foreach($gponame in $InputGPOdetails)

{

Get-GPOReport -Name $gponame -ReportType HTML | Out-File ./$gponame.html

}

Powershell Script - Listing Empty GPOs

  #Created By - Abhishek Bansal

<#Read Me !! 

1. Script Usage - Finding Empty GPOs in the domain environment.

Script Logic -  Logic revolves around GPO Template & GPO Container user & computer version. So if  a policy is created but it's not configured with any setting or it's never been edited, then the Sysvol & AD Version for both the container & template are 0.

Below Snap for reference -

2. Refer EmptyGPos.csv for the output & below is the code. #>

import-module grouppolicy

$gpos = Get-GPO -All

foreach ($gpo in $gpos)

{

    if (($gpo.Computer.DSVersion -eq 0 -and $gpo.User.DSVersion -eq 0) -and ($gpo.Computer.SysvolVersion -eq 0 -and $gpo.User.SysvolVersion -eq 0))

    {

         $gpo | Select @{n="GPO Name";e={$_.Displayname}},DomainName,Owner,@{n="GUID";e={$_.ID}},GPoStatus,CreationTime,ModificationTime | Export-Csv ./EmptyGPO.csv -NoTypeInformation -Append

    }

}