PowerShell GroupPolicy module¶

# Install the GroupPolicy management RSAT component
Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0

# Verify the installation succeeded
Get-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0 |
    Select-Object Name, State

# Install GPMC feature on Windows Server (including Server Core)
Install-WindowsFeature -Name GPMC

# Verify
Get-WindowsFeature -Name GPMC | Select-Object Name, InstallState

# Check if the module is available (without loading it)
Get-Module -Name GroupPolicy -ListAvailable

# Import explicitly if not auto-loaded (rare but can be needed in some environments)
Import-Module GroupPolicy

# List all available cmdlets organized by Noun then Verb
Get-Command -Module GroupPolicy | Sort-Object Noun, Verb | Format-Table -AutoSize

# Create a new GPO with a descriptive comment, then link it immediately
$gpo = New-GPO -Name "CFG-Postes-EnvironnementBureau" `
               -Comment "Bureau et ecran de veille — cree par J.Dupont le $(Get-Date -Format 'yyyy-MM-dd')"

New-GPLink -Guid $gpo.Id `
           -Target "OU=Postes-Standard,DC=contoso,DC=local" `
           -LinkEnabled Yes `
           -Order 3

Write-Host "GPO creee et liee : $($gpo.DisplayName)" -ForegroundColor Green

# Disable a link without removing it (useful during testing)
Set-GPLink -Name "CFG-Postes-EnvironnementBureau" `
           -Target "OU=Postes-Standard,DC=contoso,DC=local" `
           -LinkEnabled No

# Re-enable it
Set-GPLink -Name "CFG-Postes-EnvironnementBureau" `
           -Target "OU=Postes-Standard,DC=contoso,DC=local" `
           -LinkEnabled Yes

# Mark the link as Enforced (use sparingly — see Chapter 01)
Set-GPLink -Name "SEC-Postes-Baseline" `
           -Target "OU=Postes-Standard,DC=contoso,DC=local" `
           -Enforced Yes

# Write a registry value into the Computer Configuration side of a GPO
Set-GPRegistryValue -Name "CFG-Postes-EnvironnementBureau" `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization" `
    -ValueName "LockScreenImage" `
    -Type String `
    -Value "\\serveur\images\lockscreen.jpg"

# Disable the User Configuration section (GPO only has Computer settings)
Set-GPO -Name "CFG-Postes-EnvironnementBureau" -GpoStatus ComputerSettingsEnabled

# Or disable the Computer Configuration section
Set-GPO -Name "USR-Standard-Bureau" -GpoStatus UserSettingsEnabled

# Check the current status
Get-GPO -Name "CFG-Postes-EnvironnementBureau" | Select-Object DisplayName, GpoStatus

# Get a GPO by name
Get-GPO -Name "CFG-Postes-EnvironnementBureau"

# Get a GPO by GUID
Get-GPO -Guid "{a1b2c3d4-e5f6-7890-abcd-ef1234567890}"

# Get all GPOs in the domain
Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime | Sort-Object DisplayName

# Read a specific registry value from a GPO's registry.pol
Get-GPRegistryValue -Name "CFG-Postes-EnvironnementBureau" `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization" `
    -ValueName "LockScreenImage"

# Full GPO inventory with link targets, versions and modification dates
Get-GPO -All | ForEach-Object {
    $gpo = $_
    $xml  = [xml](Get-GPOReport -Guid $gpo.Id -ReportType Xml)
    $links = $xml.GPO.LinksTo | ForEach-Object { $_.SOMPath }

    [PSCustomObject]@{
        Name        = $gpo.DisplayName
        Status      = $gpo.GpoStatus
        Modified    = $gpo.ModificationTime.ToString("yyyy-MM-dd")
        ComputerVer = $gpo.Computer.DSVersion
        UserVer     = $gpo.User.DSVersion
        Links       = if ($links) { ($links -join " | ") } else { "UNLINKED" }
        Description = $gpo.Description
    }
} | Sort-Object Name | Format-Table -AutoSize -Wrap

# List all permissions on a specific GPO
Get-GPPermissions -Name "SEC-Postes-Baseline" -All |
    Select-Object @{N="Trustee"; E={$_.Trustee.Name}},
                  @{N="Type";    E={$_.Trustee.SidType}},
                  Permission |
    Format-Table -AutoSize

# Show all GPOs inherited by an OU (from domain root down)
Get-GPInheritance -Target "OU=Postes-Standard,DC=contoso,DC=local" |
    Select-Object -ExpandProperty GpoLinks |
    Select-Object DisplayName, Enabled, Enforced, Order |
    Sort-Object Order | Format-Table -AutoSize

# Generate a standalone HTML report for a GPO
Get-GPOReport -Name "SEC-Postes-Baseline" `
              -ReportType Html `
              -Path "C:\Temp\SEC-Postes-Baseline-$(Get-Date -Format 'yyyyMMdd').html"

Write-Host "Report generated: C:\Temp\SEC-Postes-Baseline-$(Get-Date -Format 'yyyyMMdd').html"

# Backup all GPOs to a timestamped folder
$backupPath = "\\serveur-backup\GPO-Backups\$(Get-Date -Format 'yyyy-MM-dd')"
New-Item -ItemType Directory -Path $backupPath -Force | Out-Null

Backup-GPO -All -Path $backupPath

Write-Host "Backup completed to: $backupPath" -ForegroundColor Green

# Backup a single GPO before making changes
$gpoName    = "SEC-Postes-Baseline"
$backupPath = "C:\Temp\GPO-Backup-Pre-Change"
New-Item -ItemType Directory -Path $backupPath -Force | Out-Null

$backup = Backup-GPO -Name $gpoName -Path $backupPath
Write-Host "Backup ID: $($backup.Id) — Path: $backupPath" -ForegroundColor Yellow

# Restore a GPO from its latest backup (replaces current settings)
Restore-GPO -Name "SEC-Postes-Baseline" -Path "\\serveur-backup\GPO-Backups\2026-04-05"

# Import settings from a backup into an existing GPO (preserves links and permissions)
Import-GPO -BackupId "{c8d9e0f1-a2b3-4c5d-6e7f-890abc123456}" `
           -TargetName "CFG-Postes-EnvironnementBureau" `
           -Path "\\serveur-backup\GPO-Backups\2026-04-05"

# Copy a GPO — creates a new GPO with the same settings but no links
Copy-GPO -SourceName "SEC-Postes-Baseline" `
         -TargetName "SEC-Postes-Baseline-TEST" `
         -CopyAcls

# Compare ADMX-based settings between two GPOs using XPath on the XML report
function Compare-GPOSettings {
    param(
        [Parameter(Mandatory)][string]$SourceGPO,
        [Parameter(Mandatory)][string]$TargetGPO
    )

    $nsManager = @{ q2 = "http://www.microsoft.com/GroupPolicy/Settings/Registry" }

    $sourceXml = [xml](Get-GPOReport -Name $SourceGPO -ReportType Xml)
    $targetXml = [xml](Get-GPOReport -Name $TargetGPO -ReportType Xml)

    $sourceSettings = $sourceXml | Select-Xml -XPath "//q2:Policy" -Namespace $nsManager |
        ForEach-Object { "$($_.Node.Name) = $($_.Node.State)" }

    $targetSettings = $targetXml | Select-Xml -XPath "//q2:Policy" -Namespace $nsManager |
        ForEach-Object { "$($_.Node.Name) = $($_.Node.State)" }

    $diff = Compare-Object $sourceSettings $targetSettings

    if ($diff) {
        Write-Host "Differences found between '$SourceGPO' and '$TargetGPO':" -ForegroundColor Yellow
        $diff | ForEach-Object {
            [PSCustomObject]@{
                Setting = $_.InputObject
                OnlyIn  = if ($_.SideIndicator -eq "<=") { $SourceGPO } else { $TargetGPO }
            }
        } | Format-Table -AutoSize
    }
    else {
        Write-Host "GPOs are identical in ADMX-based settings." -ForegroundColor Green
    }
}

# Usage
Compare-GPOSettings -SourceGPO "SEC-Postes-Baseline-PROD" -TargetGPO "SEC-Postes-Baseline-TEST"

# Also compare raw registry values written via Set-GPRegistryValue
$nsReg = @{ q1 = "http://www.microsoft.com/GroupPolicy/Settings/Registry" }

$sourceReg = $sourceXml | Select-Xml `
    -XPath "//q1:RegistrySettings/q1:Registry" -Namespace $nsReg |
    ForEach-Object { "$($_.Node.Properties.keyName)\$($_.Node.Properties.valueName) = $($_.Node.Properties.value)" }

$targetReg = $targetXml | Select-Xml `
    -XPath "//q1:RegistrySettings/q1:Registry" -Namespace $nsReg |
    ForEach-Object { "$($_.Node.Properties.keyName)\$($_.Node.Properties.valueName) = $($_.Node.Properties.value)" }

Compare-Object $sourceReg $targetReg | Format-Table -AutoSize

# Import a GPO from a backup using a migration table for cross-domain references
Import-GPO -BackupId "{c8d9e0f1-a2b3-4c5d-6e7f-890abc123456}" `
           -TargetName "SEC-Postes-Baseline" `
           -Path "\\backup-server\GPO-Backups\2026-04-05" `
           -MigrationTable "C:\Temp\migration-table.migtable" `
           -CreateIfNeeded

# Verify the imported GPO exists and has a non-zero version
Get-GPO -Name "SEC-Postes-Baseline" |
    Select-Object DisplayName, Id, GpoStatus,
                  @{N="ComputerVer"; E={$_.Computer.DSVersion}},
                  @{N="UserVer";     E={$_.User.DSVersion}}

# Find all GPOs that contain raw registry values (no ADMX backing)
# These appear as "Extra Registry Settings" in GPMC
Get-GPO -All | ForEach-Object {
    $gpo    = $_
    $report = Get-GPOReport -Guid $gpo.Id -ReportType Xml

    if ($report -match "ExtraRegistrySettings") {
        [PSCustomObject]@{
            GPO   = $gpo.DisplayName
            GUID  = $gpo.Id
            Issue = "Has Extra Registry Settings — verify Central Store ADMX coverage"
        }
    }
} | Format-Table -AutoSize

# Extract all raw registry values from a GPO's registry.pol
# These are the values written via Set-GPRegistryValue
$gpoName = "CFG-Postes-EnvironnementBureau"
$xml     = [xml](Get-GPOReport -Name $gpoName -ReportType Xml)

# XPath to find raw registry entries (not backed by ADMX)
$ns = @{ q1 = "http://www.microsoft.com/GroupPolicy/Settings/Registry" }

$xml | Select-Xml -XPath "//q1:RegistrySettings/q1:Registry" -Namespace $ns |
    ForEach-Object {
        $props = $_.Node.Properties
        [PSCustomObject]@{
            KeyPath   = $props.keyName
            ValueName = $props.valueName
            Type      = $props.type
            Value     = $props.value
        }
    } | Format-Table -AutoSize

# Force a gpupdate on a single remote computer
Invoke-GPUpdate -Computer "PC-JULIEN-01" -Force -RandomDelayInMinutes 0

# Force gpupdate on all computers in an OU
# Get computer accounts from the OU, then invoke gpupdate on each
$ou = "OU=Postes-Pilote,DC=contoso,DC=local"

$computers = Get-ADComputer -Filter * -SearchBase $ou |
             Where-Object { $_.Enabled -eq $true } |
             Select-Object -ExpandProperty Name

Invoke-GPUpdate -Computer $computers -Force -RandomDelayInMinutes 0 |
    Select-Object ComputerName, Status | Format-Table -AutoSize

# Simulate RSoP for a specific user on a specific computer (planning mode)
Get-GPResultantSetOfPolicy -Computer "PC-JULIEN-01" `
                           -User "CONTOSO\j.dupont" `
                           -ReportType Html `
                           -Path "C:\Temp\rsop-j.dupont-PC-JULIEN-01.html"

# GPO Inventory Script — production-ready, exports to timestamped CSV
# Run from any workstation with RSAT GroupPolicy module installed

$exportPath = "C:\Temp\gpo-inventory-$(Get-Date -Format 'yyyyMMdd-HHmm').csv"

$report = Get-GPO -All | ForEach-Object {
    $gpo = $_
    $xml = [xml](Get-GPOReport -Guid $gpo.Id -ReportType Xml)

    # Count configured extension sections (not individual settings)
    $computerExtCount = ($xml | Select-Xml "//Computer/ExtensionData").Count
    $userExtCount     = ($xml | Select-Xml "//User/ExtensionData").Count

    # Check for raw registry values (no ADMX backing)
    $hasExtraRegistry = ($xml.OuterXml -match "ExtraRegistrySettings")

    # Get linked OUs with their enabled/enforced state
    $links = $xml.GPO.LinksTo | ForEach-Object {
        "$($_.SOMPath) [enabled=$($_.Enabled), enforced=$($_.NoOverride)]"
    }

    [PSCustomObject]@{
        DisplayName      = $gpo.DisplayName
        Id               = $gpo.Id
        Status           = $gpo.GpoStatus
        Created          = $gpo.CreationTime.ToString("yyyy-MM-dd")
        Modified         = $gpo.ModificationTime.ToString("yyyy-MM-dd")
        ComputerVersion  = $gpo.Computer.DSVersion
        UserVersion      = $gpo.User.DSVersion
        ComputerExtCount = $computerExtCount
        UserExtCount     = $userExtCount
        HasExtraRegistry = $hasExtraRegistry
        LinkCount        = @($xml.GPO.LinksTo).Count
        Links            = if ($links) { ($links -join " || ") } else { "UNLINKED" }
        Description      = ($gpo.Description -replace "`n", " ").Trim()
        Owner            = $gpo.Owner
    }
}

$report | Export-Csv -Path $exportPath -NoTypeInformation -Encoding UTF8
Write-Host "Exported $($report.Count) GPOs to: $exportPath" -ForegroundColor Green

# Quick summary to the console
$unlinked     = ($report | Where-Object { $_.Links -eq "UNLINKED" }).Count
$extraReg     = ($report | Where-Object { $_.HasExtraRegistry }).Count
$bothDisabled = ($report | Where-Object { $_.Status -eq "AllSettingsDisabled" }).Count

Write-Host ""
Write-Host "Summary:" -ForegroundColor Cyan
Write-Host "  Total GPOs       : $($report.Count)"
Write-Host "  Unlinked GPOs    : $unlinked"
Write-Host "  Extra Registry   : $extraReg"
Write-Host "  Fully disabled   : $bothDisabled"

# Parallel GPO report generation (PowerShell 7+ only)
$allGPOs = Get-GPO -All

$results = $allGPOs | ForEach-Object -Parallel {
    $gpo = $_
    $xml = [xml](Get-GPOReport -Guid $gpo.Id -ReportType Xml)
    $links = $xml.GPO.LinksTo | ForEach-Object { $_.SOMPath }

    [PSCustomObject]@{
        Name     = $gpo.DisplayName
        Links    = if ($links) { $links -join " | " } else { "UNLINKED" }
        Modified = $gpo.ModificationTime.ToString("yyyy-MM-dd")
    }
} -ThrottleLimit 10  # Max 10 concurrent calls to avoid overloading the DC

$results | Sort-Object Name | Format-Table -AutoSize

# Cache the XML report to avoid double network calls
$xml = [xml](Get-GPOReport -Name "SEC-Postes-Baseline" -ReportType Xml)

# Use $xml multiple times without additional network calls
$computerSettings = $xml | Select-Xml "//Computer/ExtensionData"
$links            = $xml.GPO.LinksTo
$hasExtraReg      = $xml.OuterXml -match "ExtraRegistrySettings"