Przemyslaw Klys
42f3053896
Improved the PowerShell script to account for special '.gpf' files when evaluating whether a Group Policy Object (GPO) is empty. Previously, GPOs containing only these files were incorrectly marked as empty since they weren't visible in the XML output. This update ensures that GPOs with '.gpf' files are recognized as non-empty. Additionally, the script now includes the SYSVOL path and the count of files within each GPO in its summary output, aiding in thorough GPO analysis. This enhancement resolves issues with incomplete policy reporting and assists administrators in scenarios where Citrix or other applications rely on .gpf files for storing their settings. Refs: #49
GPOZaurr
Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them. GPOZaurr provides 360 degrees of information about Group Policies and their settings.
Just a single command (Invoke-GPOZaurr) provides following reports:
- GPOBroken
- GPOBrokenLink
- GPOOwners
- GPOConsistency
- GPODuplicates
- GPOOrganizationalUnit
- GPOList
- GPOLinks
- GPOPassword
- GPOPermissions
- GPOPermissionsAdministrative
- GPOPermissionsRead
- GPOPermissionsRoot
- GPOPermissionsUnknown
- GPOFiles
- GPOBlockedInheritance
- GPOAnalysis
- GPOUpdates
- NetLogonOwners
- NetLogonPermissions
- SysVolLegacyFiles
But that's not all. There are over 50 other commands available that make it even more powerful helping with day to day tasks to manage Group Policies.
To understand the usage of Invoke-GPOZaurr I've created blog post you may find useful
Installing
GPOZaurr requires RSAT installed to provide results. If you don't have them you can install them as below. Keep in mind it also installs GUI tools so it shouldn't be installed on user workstations.
# Windows 10 Latest
Add-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0'
Add-WindowsCapability -Online -Name 'Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0'
Finally just install module:
Install-Module -Name GPOZaurr -AllowClobber -Force
Force and AllowClobber aren't necessary, but they do skip errors in case some appear.
Updating
Update-Module -Name GPOZaurr
That's it. Whenever there's a new version, you run the command, and you can enjoy it. Remember that you may need to close, reopen PowerShell session if you have already used module before updating it.
The essential thing is if something works for you on production, keep using it till you test the new version on a test computer. I do changes that may not be big, but big enough that auto-update may break your code. For example, small rename to a parameter and your code stops working! Be responsible!