Hi all,

I am looking for a script which will get all GPO's by name, the OU's they are linked to (Enabled/Disabled/Forced), Settings (Computer or User enabled/disabled, Security Filter and perhaps Delegation info as well. I would like to get this information and export it to Excel or a file that can them to imported into Excel or a table in word for a report I wish to create.

I can run the following but that exports too much information:

Get-GPOReport -name USER-TST-CTX -ReportType XML -Path C:\temp\GPOReport1.xml

My scripting/powershell isn't really up to scratch and all the scripts I've found through searches don't seem to work, are old posts or don't do what I would like.

I'm using SCM to export, compare and detail the specific settings so I'm Ok there.

Any help would be great.

Thanks.

• Edited by andrewjohnporter Tuesday, September 08, 2015 8:14 AM

$date = Get-Date -Format yyyyMMddhhmmss
 $file = "C:\Users\username\Documents\Scripts\GPO\gpos_$date.csv"
 Add-Content $file "Name,LinksPath,WMI Filter,CreatedTime,ModifiedTime,CompVerDir,CompVerSys,UserVerDir,UserVerSys,CompEnabled,UserEnabled,SecurityFilter,GPO Enabled,Enforced"
$GPOList = (Get-Gpo -All).DisplayName
$colGPOLinks = @()
$LinksPaths = @()
foreach ($GPOItem in $GPOList){
 
      $LinksPaths = "" 
      $LinksPath = ""
 
    [xml]$gpocontent =  Get-GPOReport $GPOItem -ReportType xml
 
       $LinksPaths = $gpocontent.GPO.LinksTo #| %{$_.SOMPath}
    
    $Wmi = Get-GPO $GPOItem | Select-Object WmiFilter
 
    $CreatedTime = $gpocontent.GPO.CreatedTime
    $ModifiedTime = $gpocontent.GPO.ModifiedTime
    $CompVerDir = $gpocontent.GPO.Computer.VersionDirectory
    $CompVerSys = $gpocontent.GPO.Computer.VersionSysvol
    $CompEnabled = $gpocontent.GPO.Computer.Enabled
    $UserVerDir = $gpocontent.GPO.User.VersionDirectory
    $UserVerSys = $gpocontent.GPO.User.VersionSysvol
    $UserEnabled = $gpocontent.GPO.User.Enabled
    $SecurityFilter = ((Get-GPPermissions -Name $GPOItem -All | ?{$_.Permission -eq "GpoApply"}).Trustee | ?{$_.SidType -ne "Unknown"}).name -Join ','
   if($LinksPaths -ne $null)
   {
        foreach ($LinksPath in $LinksPaths)
        {
            Add-Content $file "$GPOItem,$($LinksPath.SOMPath),$(($wmi.WmiFilter).Name),$CreatedTime,$ModifiedTime,$CompVerDir,$CompVerSys,$UserVerDir,$UserVerSys,$CompEnabled,$UserEnabled,""$($SecurityFilter)"",$($LinksPath.Enabled),$($LinksPath.NoOverride)"
        }
    
    }
    else
    {#Write-Host "Empty Links"  
            Add-Content $file "$GPOItem,$($LinksPath.SOMPath),$(($wmi.WmiFilter).Name),$CreatedTime,$ModifiedTime,$CompVerDir,$CompVerSys,$UserVerDir,$UserVerSys,$CompEnabled,$UserEnabled,""$($SecurityFilter)"",$($LinksPath.Enabled),$($LinksPath.NoOverride)"
    } 
}
 

Then you can edit the values into the CSV if you would like.

• Marked as answer by andrewjohnporter 4 hours 2 minutes ago

Hi andrewjohnporter,

Thanks for your post.

You coul specify a GPO by its display name, or you can get all the GPOs in the domain by specifying the All parameter with the Get-GPO cmdlet.

You may refer to the article for more details.

https://technet.microsoft.com/en-us/library/Ee461059.aspx?f=255&MSPPError=-2147217396

http://blogs.technet.com/b/heyscriptingguy/archive/2009/02/09/how-can-i-list-all-group-policy-objects-in-a-domain.aspx

In addition, for more support about speific scrips you could also post in Our Script Forum

https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?category=scripting

Best Regards.

Mary Dong

That's great! Thanks vaadadmin2010!

I assume that:

 - CompVerDir + CompVerSys = computers that the GPO applies to?

 - UserVerDir + UserVerSys = users that the GPO applies to?

Cheers

Those are the version numbers of the GPO between the Sysvol part and the Directory part. 

Read this to get an understanding of the makeup of GPO:  http://blogs.technet.com/b/musings_of_a_technical_tam/archive/2012/02/13/understanding-the-structure-of-a-group-policy-object.aspx

Don't thank me too much, I modified a script from the web (probably TechNet), but unfortunately I can't find the source right now, so we to thank him or her.

Ah yes, of course, thanks again vaad, Mary and to whoever that random script creator is!