Alan's Blog

"Yeah. I wrote a script that will do that."

Clear GPO Cache on Remote Computer with PowerShell

Posted on August 13th, 2017

Clearing the GPO cache on a computer may be the only way to fix a persistent problem.  Doing this involves deleting files, registry entries, and rebuilding the security database.  Clear-GPOCache.ps1 works by creating a custom batch file on the remote computer, then scheduling a task running as System to run the process with the required rights.

There are some interesting code bits, such as getting the remote time for the scheduled task.  The task is logged in a text file and in the event log.

Script Text

Tags: ,
Filed under Active Directory, Batch, Group Policy Objects, PowerShell, Scripting, Windows Administration | No Comments »

Update GPOs with Newer Version

Posted on March 1st, 2017

If you use GPOs to enforce baselines, you may find that your enterprise is moving from version 1.1 to version 1.2 of a GPO.  Unfortunately for you, version 1.1 linked in a dozen places.  Wouldn’t you rather just you search for version 1.1 and replace it with version 1.2?  Use Update-GPOLinks.ps1 to do just that.  The script not only finds all the original links and updates them to the new version, it also keeps the link order.

Script Text

Tags: ,
Filed under Alan's Favorites, My Best, PowerShell, Scripting, Windows Administration | No Comments »

Get All GPOs Linked to an OU

Posted on March 1st, 2017

Get-AllGPOsLinkedToOU.ps1 returns a unique list of all GPO’s linked to an OU. You can also run a onelevel or subtree search to get a unique list of linked OUs at or below the selected OU. You are prompted for the domain, and navigate to desired OU.
Script Text

Tags: ,
Filed under Active Directory, Group Policy Objects, PowerShell, Windows Administration | No Comments »

Reset GPO Cache

Posted on March 1st, 2017

This script deletes the locally stored copies of GPOs and forces a GPUPdate on a computer. Reset-GPOCache.ps1 works by a remote connection to the registry provider to get the path to the Group Policy\History folder, then deletes the files beneath that path. This ensures a fresh application of group polices.

Script Text

Tags: ,
Filed under Active Directory, Group Policy Objects, PowerShell, Windows Administration | No Comments »

Get Resultant Set of Polices (RSOP) with User Selection

Posted on March 1st, 2017

The Get-GPResultantSetOfPolicy cmdlet in the GroupPolicy module of PowerShell has a parameter for a user name.  Often I have no idea who has logged onto the computer.  Get-RSOP.ps1 uses WMI to give you a pick list of users on the remote computer and then passes that to the user parameter of Get-GPResultantSetOfPolicy.

Script Text

Tags: ,
Filed under Active Directory, Group Policy Objects, PowerShell, Scripting, Windows Administration | No Comments »

How to Edit the Path for Shares and Printers inside a GPO

Posted on March 26th, 2016

Here is the unsupported method from Microsoft for editing the path for shares and printers inside a GPO.

From a server —
1) Backup the problem GPO to your desktop
2) Edit the gpreport.xml and backup.xml files
3) Import the edited GPO

The engineer said if you have to do both, update the path for the file shares first.

If we still had a lot to do, I’d write a script to automate this process
— but we don’t.

Filed under Group Policy Objects | No Comments »

Compare Group Policy Objects

Posted on September 14th, 2014

Our Active Directory lead recently complained to me that he didn’t have a good way to compare Group Policy Objects.  I had already written the Group Policy Reporter, which exports GPOs to HTML files, and it occurred to me that comparing two HTML files would be pretty easy.  But my experiments with Compare-Object led to some pretty ugly results.  I frequently compare documents using MS Word, and I decided to use Word to do the comparison of the files.

The new script, GPOCompare.ps1, makes a list of your GPOs and displays that list using Out-GridView.  After you select two GPOs, you are asked which is the “original” (earlier) GPO for Word to use as the original document.  The HTML reports are created, then a comparison is made using Word.  This script requires PowerShell 3, The Group Policy Management Console, and Word installed.

The Word COM object is not fun to work with in PowerShell.  In particular, you cannot use $Null for some of the unused parameters, and note that many must be explicit references, example [REF]$True.

Script Text

Filed under Active Directory, PowerShell, Windows Administration | No Comments »

PowerShell GPO Reporter

Posted on June 10th, 2013

Over the past few months I have been spending more and more time working with PowerShell.  I have gone to Windows 8 on my personal laptop, and am impressed by PowerShell 3.0.  I have joined the Charlotte PowerShell User’s Group which meets monthly at the Charlotte Microsoft Campus.  The Scripting Guy, Ed Wilson, together with his Teresa are regular attendees of the meetings,  and at last month’s meeting I won a signed copy of Ed’s latest book, PowerShell 3.0 Step by Step.  I shared some struggles I was having with PowerShell, and Ed gave me some practical advice about how to proceed.  It was something I already knew — focus on a real world problem and don’t be concerned about writing elegant code.

For some time, I have been getting traffic for my GPO Reporter HTA.  Unfortunately, this requires a component that was last available in Windows XP.  I quit using XP (even VMs) last month, and the loss of the GPO Reporter soon became a problem.  Fortunately, this month’s POSH meeting was led by Microsoft PFE Jason Walker who covered Active Directory and PowerShell.  I decided to take another look at a PowerShell GPO Reporter.

I think I have done some interesting things in the coding of the new script, GPOReports.ps1, but it is hard to tell as I am still a PowerShell beginner.  I have commented the code to make things easier to understand.  This script requires PowerShell 3.  Also note that you will need to install the Remote Server Administration Tools (RSAT) to get this to work, as it provides the ActiveDirectory PowerShell Module.  It is available for Windows 7 and Windows 8. This is unsigned code, if you are a PowerShell noob, take a look at execution policy explanations about how to get it to run.


Filed under PowerShell, Windows Administration | No Comments »

GPO Reporter HTA

Posted on March 19th, 2009

This HTA (gporeporter) allows you to export GPO settings into HTML files.  This is a good way to document and to search GPO settings.  Requires the Group Policy Management Console, you will be prompted to install it if necessary. Note: The GPMC does not work with Windows 7.

Update: 6/10/13:  I have published a PowerShell version of the GPO Reporter.

Filed under Alan's Favorites, Computing, HTA, Scripting, Windows Administration | No Comments »

Please Note

All the scripts are saved as .txt files. Newer files have a "View Script" button which will let you save or open a script in notepad. For earlier posts, the easiest way to download with IE is to right click on the link and use "Save Target As". Rename file from Name_ext.txt to Name.ext.

To see a full post after searching, please click on the title.

PowerShell Scripts were written with Version 3 or 4.

https connections are supported.

All new users accounts must be approved, as are comments. Please be patient. It is pretty easy to figure out my email address from the scripts, and you are welcome to contact me that way.

Site Search



SQL Site

Bad Behavior has blocked 262 access attempts in the last 7 days.