How to list delegation settings for "Group Policy Objects" (PowerShell)

Question

Hello,

I am using Windows Server 2019.

Using Powershell, I want to list the users/groups which can be found here:

Group Policy Management Console > Group Policy Objects > Delegation

Here is a screenshot:

I can list the delegations for individual GPOs using this command: Get-GPPermission -Name "Policy Name" -All

However, I cannot find a command to list the settings for the "Group Policy Objects" tab.

Answer 1

Hi @John

I don't think there is a GPO command to return the permissions of the 'Group Policy Objects'. The tab is showing a filtered view of the permissions assigned to the Policies container in the AD i.e. CN=Policies,CN=System,DC=w2k12,DC=local.

The tab will only show the permissions that have permissions to create GPO objects.

Gary.

Answer 2

Hi John/anyone, who still have this ask, feel free to use below script which I have created to provide you detailed report on all GPOs permissions/delegation in your domain, it also uses get-gppermissions cmdlet but gives u nicer output with GPO Name in it.

https://github.com/vamdevmishra/MyScripts/blob/master/gpopermsreport.ps1

Answer 3

You can find below script :-

$gpos = Get-GPO -All

foreach ($gpo in $gpos) { Write-Output "GPO: $($gpo.DisplayName)"

try {

$permissions = Get-GPPermissions -Guid $gpo.Id -All

if ($permissions) {

    foreach ($permission in $permissions) {

        Write-Output "`t $($permission.Trustee.Name)"

    }

}

else {

    Write-Output "`t No members found."

}

} catch {

Write-Output "`t Error retrieving permissions: $($_.Exception.Message)"

}

Write-Output ""

}