Le format registry.pol¶

function Read-RegistryPol {
    <#
    .SYNOPSIS
        Parses a registry.pol file and returns its records as objects.
    .PARAMETER Path
        UNC or local path to the registry.pol file.
    #>
    param(
        [Parameter(Mandatory)]
        [string]$Path
    )

    $bytes = [System.IO.File]::ReadAllBytes($Path)

    # Validate PReg signature (bytes 0-3 = ASCII "PReg")
    $signature = [System.Text.Encoding]::ASCII.GetString($bytes[0..3])
    if ($signature -ne 'PReg') {
        throw "Invalid file: PReg signature not found at offset 0x00. Got: '$signature'"
    }

    # Validate version (bytes 4-7 = DWORD 1 little-endian)
    $version = [BitConverter]::ToInt32($bytes, 4)
    if ($version -ne 1) {
        Write-Warning "Unexpected PReg version: $version (expected 1)"
    }

    $offset = 8  # Skip 8-byte header
    $records = [System.Collections.Generic.List[PSCustomObject]]::new()

    while ($offset -lt $bytes.Length) {

        # Each record starts with '[' (0x5B 0x00 in UTF-16LE)
        if ($bytes[$offset] -ne 0x5B -or $bytes[$offset + 1] -ne 0x00) {
            break
        }
        $offset += 2

        # --- Read registry key path (UTF-16LE, null-terminated, ends at ';') ---
        $fieldStart = $offset
        while ($offset -lt $bytes.Length) {
            if ($bytes[$offset] -eq 0x3B -and $bytes[$offset + 1] -eq 0x00) { break }
            $offset += 2
        }
        $keyPath = [System.Text.Encoding]::Unicode.GetString($bytes[$fieldStart..($offset - 1)]).TrimEnd([char]0)
        $offset += 2  # Skip ';'

        # --- Read value name (UTF-16LE, null-terminated, ends at ';') ---
        $fieldStart = $offset
        while ($offset -lt $bytes.Length) {
            if ($bytes[$offset] -eq 0x3B -and $bytes[$offset + 1] -eq 0x00) { break }
            $offset += 2
        }
        $valueName = [System.Text.Encoding]::Unicode.GetString($bytes[$fieldStart..($offset - 1)]).TrimEnd([char]0)
        $offset += 2  # Skip ';'

        # --- Read type (4-byte DWORD) ---
        $regType = [BitConverter]::ToInt32($bytes, $offset)
        $offset += 4
        $offset += 2  # Skip ';'

        # --- Read size (4-byte DWORD) ---
        $dataSize = [BitConverter]::ToInt32($bytes, $offset)
        $offset += 4
        $offset += 2  # Skip ';'

        # --- Read raw data bytes ---
        $rawData = $bytes[$offset..($offset + $dataSize - 1)]
        $offset += $dataSize
        $offset += 2  # Skip ']'

        # Decode data based on registry type
        $decodedValue = switch ($regType) {
            1  { [System.Text.Encoding]::Unicode.GetString($rawData).TrimEnd([char]0) }  # REG_SZ
            2  { [System.Text.Encoding]::Unicode.GetString($rawData).TrimEnd([char]0) }  # REG_EXPAND_SZ
            4  { [BitConverter]::ToInt32($rawData, 0) }                                   # REG_DWORD
            11 { [BitConverter]::ToInt64($rawData, 0) }                                   # REG_QWORD
            7  {                                                                           # REG_MULTI_SZ
                [System.Text.Encoding]::Unicode.GetString($rawData).Split([char]0, [System.StringSplitOptions]::RemoveEmptyEntries)
            }
            default { $rawData }  # REG_BINARY and others: return raw bytes
        }

        $typeName = @{1='REG_SZ';2='REG_EXPAND_SZ';3='REG_BINARY';4='REG_DWORD';7='REG_MULTI_SZ';11='REG_QWORD'}[$regType] ?? "REG_UNKNOWN($regType)"

        $records.Add([PSCustomObject]@{
            KeyPath   = $keyPath
            ValueName = $valueName
            TypeId    = $regType
            TypeName  = $typeName
            DataSize  = $dataSize
            Value     = $decodedValue
        })
    }

    return $records
}

# Read Machine-side registry.pol for a specific GPO
$polPath = "\\contoso.local\SYSVOL\contoso.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Registry.pol"
$records = Read-RegistryPol -Path $polPath

# Display all records
$records | Format-Table KeyPath, ValueName, TypeName, Value -AutoSize

# Filter on a specific key subtree
$records | Where-Object { $_.KeyPath -like '*\Policies\Microsoft\Windows\WindowsUpdate*' }

# Count records by type
$records | Group-Object TypeName | Sort-Object Count -Descending

KeyPath                                              ValueName        TypeName   Value
-------                                              ---------        --------   -----
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate    WUServer         REG_SZ     https://wsus.contoso.local:8530
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate    WUStatusServer   REG_SZ     https://wsus.contoso.local:8530
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU UseWUServer      REG_DWORD  1
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions        REG_DWORD  4
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU ScheduledInstallDay REG_DWORD 0

# Increment GPO version after manually editing registry.pol
# Run this AFTER copying the modified registry.pol to SYSVOL
param(
    [Parameter(Mandatory)]
    [string]$GPOGuid,

    [string]$Domain = $env:USERDNSDOMAIN,

    # Which side was modified: Machine, User, or Both
    [ValidateSet('Machine', 'User', 'Both')]
    [string]$Side = 'Machine'
)

$sysvolBase  = "\\$Domain\SYSVOL\$Domain\Policies"
$gptIniPath  = "$sysvolBase\{$GPOGuid}\GPT.INI"

# Read current version from GPT.INI
$iniContent     = Get-Content $gptIniPath -Raw
$currentVersion = [int]([regex]::Match($iniContent, '(?m)^Version=(\d+)').Groups[1].Value)

$machinePart = $currentVersion -band 0x0000FFFF
$userPart    = ($currentVersion -band 0xFFFF0000) -shr 16

# Increment the relevant counter(s)
if ($Side -eq 'Machine' -or $Side -eq 'Both') { $machinePart++ }
if ($Side -eq 'User'    -or $Side -eq 'Both') { $userPart++    }

$newVersion = ($userPart -shl 16) -bor $machinePart

# Update GPT.INI
$newContent = $iniContent -replace '(?m)^Version=\d+', "Version=$newVersion"
Set-Content -Path $gptIniPath -Value $newContent -Encoding ASCII -NoNewline

# Update versionNumber attribute on the GPC in Active Directory
$domainDN = (Get-ADDomain -Identity $Domain).DistinguishedName
$gpoDN    = "CN={$GPOGuid},CN=Policies,CN=System,$domainDN"
Set-ADObject -Identity $gpoDN -Replace @{ versionNumber = $newVersion }

Write-Host "GPO {$GPOGuid} version updated: $currentVersion --> $newVersion (machine=$machinePart, user=$userPart)"

GPO {31B2F340-016D-11D2-945F-00C04FB984F9} version updated: 65537 --> 65538 (machine=2, user=1)

function Test-RegistryPolIntegrity {
    param(
        [Parameter(Mandatory)]
        [string]$Path
    )

    if (-not (Test-Path $Path)) {
        Write-Warning "File not found: $Path"
        return $false
    }

    $bytes = [System.IO.File]::ReadAllBytes($Path)

    # Must have at least the 8-byte header
    if ($bytes.Length -lt 8) {
        Write-Warning "File too small: $($bytes.Length) bytes (minimum 8)"
        return $false
    }

    # Check PReg signature
    $sig = [System.Text.Encoding]::ASCII.GetString($bytes[0..3])
    if ($sig -ne 'PReg') {
        Write-Warning "Invalid signature: '$sig' (expected 'PReg')"
        return $false
    }

    # Check version
    $ver = [BitConverter]::ToInt32($bytes, 4)
    if ($ver -ne 1) {
        Write-Warning "Unexpected version: $ver (expected 1)"
        return $false
    }

    # Walk through records to detect truncation
    $offset = 8
    $count = 0
    try {
        while ($offset -lt $bytes.Length) {
            if ($bytes[$offset] -ne 0x5B) { break }
            $offset += 2
            # Skip key
            while ($bytes[$offset] -ne 0x3B -or $bytes[$offset+1] -ne 0x00) { $offset += 2 }
            $offset += 2
            # Skip value name
            while ($bytes[$offset] -ne 0x3B -or $bytes[$offset+1] -ne 0x00) { $offset += 2 }
            $offset += 2
            # Skip type (4) + semicolon (2)
            $offset += 6
            # Read size
            $size = [BitConverter]::ToInt32($bytes, $offset)
            $offset += 6  # size + semicolon
            # Skip data + closing bracket
            $offset += $size + 2
            $count++
        }
        Write-Host "OK: $count records, $($bytes.Length) bytes total"
        return $true
    }
    catch {
        Write-Warning "Parse error at offset 0x$($offset.ToString('X4')): $_"
        return $false
    }
}

OK: 47 records, 3842 bytes total

# Filter Group Policy operational log for Registry CSE events
$cutoff = (Get-Date).AddHours(-24)
Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -ErrorAction SilentlyContinue |
    Where-Object {
        $_.TimeCreated -gt $cutoff -and
        $_.Id -in @(4016, 5016, 6016, 7016, 4098, 1096)
    } |
    Select-Object TimeCreated, Id, LevelDisplayName, Message |
    Format-Table -AutoSize -Wrap

TimeCreated           Id    LevelDisplayName  Message
-----------           --    ----------------  -------
05/04/2026 08:43:12   5016  Information       The Registry client-side extension ran successfully in ...
05/04/2026 08:43:11   4016  Information       Starting the Registry client-side extension processing ...
04/04/2026 17:22:08   7016  Error             The Registry client-side extension failed...

# Compare GPC (AD) version with GPT (SYSVOL GPT.INI) version for all GPOs
Import-Module ActiveDirectory, GroupPolicy

Get-GPO -All | ForEach-Object {
    $gpo    = $_
    $guid   = $gpo.Id.ToString('B').ToUpper()
    $domain = $gpo.DomainName

    # Read version from AD (GPC)
    $gpoDN     = "CN=$guid,CN=Policies,CN=System,$((Get-ADDomain -Identity $domain).DistinguishedName)"
    $adVersion = (Get-ADObject -Identity $gpoDN -Properties versionNumber).versionNumber

    # Read version from GPT.INI
    $gptPath  = "\\$domain\SYSVOL\$domain\Policies\$guid\GPT.INI"
    $gptVer   = 0
    if (Test-Path $gptPath) {
        $line   = (Get-Content $gptPath) | Where-Object { $_ -match '^Version=' }
        $gptVer = [int]($line -replace 'Version=', '')
    }

    [PSCustomObject]@{
        GPOName    = $gpo.DisplayName
        GUID       = $guid
        ADVersion  = $adVersion
        GPTVersion = $gptVer
        InSync     = ($adVersion -eq $gptVer)
    }
} | Where-Object { -not $_.InSync } | Format-Table -AutoSize

GPOName                    GUID                                   ADVersion  GPTVersion  InSync
-------                    ----                                   ---------  ----------  ------
WSUS Configuration         {A1B2C3D4-...}                        65538      65537       False

# Audit WSUS configuration deployed via GPO by reading registry.pol directly
# No need for RSoP or gpresult — reads the source of truth in SYSVOL

param(
    [string]$Domain       = $env:USERDNSDOMAIN,
    [string]$WsusKeyPath  = 'SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
)

$policiesRoot = "\\$Domain\SYSVOL\$Domain\Policies"
$wsusValues   = @('WUServer', 'WUStatusServer', 'UseWUServer', 'AUOptions', 'ScheduledInstallDay')

# Enumerate all GPOs
Get-GPO -All -Domain $Domain | ForEach-Object {
    $gpo  = $_
    $guid = $gpo.Id.ToString('B').ToUpper()
    $polPath = "$policiesRoot\$guid\Machine\Registry.pol"

    if (-not (Test-Path $polPath)) { return }

    # Parse and filter on WindowsUpdate key
    $records = Read-RegistryPol -Path $polPath |
        Where-Object { $_.KeyPath -like "$WsusKeyPath*" }

    if (-not $records) { return }

    Write-Host "`n=== GPO: $($gpo.DisplayName) ===" -ForegroundColor Cyan

    $records | ForEach-Object {
        $display = if ($_.Value -is [byte[]]) {
            "0x" + ($_.Value | ForEach-Object { $_.ToString('X2') }) -join ''
        } else { $_.Value }

        [PSCustomObject]@{
            Key       = $_.KeyPath -replace [regex]::Escape($WsusKeyPath), '...'
            ValueName = $_.ValueName
            Type      = $_.TypeName
            Value     = $display
        }
    } | Format-Table -AutoSize
}

=== GPO: WSUS - Production ===

Key                    ValueName            Type       Value
---                    ---------            ----       -----
...                    WUServer             REG_SZ     https://wsus.contoso.local:8530
...                    WUStatusServer       REG_SZ     https://wsus.contoso.local:8530
...\AU                 UseWUServer          REG_DWORD  1
...\AU                 AUOptions            REG_DWORD  4
...\AU                 ScheduledInstallDay  REG_DWORD  0
...\AU                 ScheduledInstallTime REG_DWORD  3

# Read local machine GPO registry.pol
$localPol = Read-RegistryPol -Path "C:\Windows\System32\GroupPolicy\Machine\Registry.pol"
$localPol | Format-Table KeyPath, ValueName, TypeName, Value -AutoSize