In this module, I'm going to talk about and introduce the concept of group policy scripting.
Now, primarily, this is going to be a PowerShell discussion, but I will touch on some capabilities
that are still available via VBScript that provides some neat functions and neat capabilities within
group policy management.
So Microsoft, since Windows seven, has provided this PowerShell module for group policy as a function
of EMC.
So when you install PMC on Windows seven or as it comes installed by default in Server 2012 and server
2016 or server 2022, you will get the command lets the PowerShell command lets the come with the group
policy module installed by default.
So once PMC is installed, you're all good to go.
And I'll talk a little bit more about what that limit is and what you can and can't do with the command
lets.
So this is just a screenshot.
If I type get command dash modal space group policy lists out all the command lets and a couple aliases
within the group policy model on Windows Server.
And these command, let's really provide capabilities over a range of management tasks.
So if you call that, PowerShell has this kind of verb noun structure.
Get GPO, backup GPO.
These are all the verbs available under the GPO noun backup copy get import new remove, rename and
restore.
In terms of GPL permissions you can get in set permissions and these are permissions on the GPO itself.
You can get her said inheritance.
And this is really just a matter of getting or setting that flag that you can stick on or use and domains
to block inheritance.
So you can either get the value of that or you or domain or set the value for GB link, which is the
a link on a site domain.
Or you you can create a new link, you can remove a link and you can set the link so you can change
the properties on a link using the set verb with GPO report.
This is simply a group policy settings report in either HTML or XAML format.
You can get that and you can get or create new starter GPOs, so you can create a new starter GPO using
the new starter GPO Command.
Let invoke update.
It was actually added in Windows eight and beyond.
And it is basically a remote group policy update or update.
So you can literally invoke a remote update just like you can from the UI and PMC, you can do it from
PowerShell.
The get result instead of policy essentially lets you run an RSP report against a remote system so you
can get RSP data from that command one and the final two verb noun combinations are get remove and set
pref registry value and get remove set GP registry value and they respectively let you set or get GP
preference registry settings and admin template settings.
That GP registry value lets you set admin template settings.
So I'm not going to go into that.
I sort of consider those to be a little bit more advanced commandments, but those are the limitations
right now for being able to modify settings.
So let's kind of look overall at the limitations in the current command.
Let's set so that you know what you can and cannot do with the PowerShell command.
Let's so today there is really no support outside of the two areas that I just mentioned.
Admin templates in GP Preferences Registry.
If no support for readying or modifying settings in PowerShell from Microsoft, there's no support for
retrieving GPO links.
So for example, there's no get GP link.
You can set links, you can create new links, but you can't get links.
You can't get information about existing links, which is, I think, a big oversight.
And by the way, my GMC complete GMC module does include a get link function, no support at all for
creating, linking, editing or deleting WMI filter.
So you can't really do anything in PowerShell with respect to managing WMI filters.
No support for setting the GPO status.
It can be done, but it's an indirect thing.
So there's no blood set that says said GPIO status, for example, no support for managing the delegation
other than the actual GPIO delegation or the permissions on the GPIO.
So if you remember from my module on GPIO delegation, we could set delegation for things like who can
link to which I'll use that's not supported in the command links.
I will say that a lot of the functionality that Microsoft provides in PMC is available through a call
API that's used indirectly by these PowerShell command lets and you can use PowerShell to interact with
the com APIs directly to get access to funds, a tonality that's not available in the Microsoft Command
lets.
Now I'm not going to cover that again because it's a little bit more of an advanced topic.
But there's lots of information out on the Internet about using the COM APIs and GM PC directly from
PowerShell.
So let's kind of dig in and look at just sort of take a tour around the group policy module and see
how it works.