Thomas Bouchereau's Blog

AGPM 4.0 SP3 Hotfix Package 1

Thomas Bouchereau (PFE) — Tue, 05 Jan 2016 04:39:00 GMT

If you have been using AGPM SP3 since it’s release you might have run into the issue where AGPM could not generate Difference reports for controlled GPOs.

A hotfix for this issue has been released during the holidays season.
HotFix Package for Microsoft Advanced Group Policy Management 4.0 SP3

Once installed on the AGPM server you will be able to generate the Difference reports has usual.

Checking AGPM GPOs managed with powershell

Thomas Bouchereau (PFE) — Thu, 15 Oct 2015 05:32:00 GMT

Hi all,

It's been a long time since I posted anything here. Basically life, baby and all that happened taking all of my free time.
That doesn't mean I have stopped working with GPOs and Powershell.

Recently a new version of AGPM has been released : AGPM 4.0 SP3: https://technet.microsoft.com/en-us/library/mt346469.aspx

On top of now being compatible with Windows 10 client, it also introduce the first set of Powershell cmdlets for AGPM: https://technet.microsoft.com/en-us/library/mt445493.aspx

I have been promoting AGPM to my clients for a while now.
One of the "issue" that was reported with AGPM by clients, was that it introduced an issue in GPMC.

What I mean is that after installing AGPM you have the add-in "Change Control" that appears in GPMC

This is where "AGPM" is and where you should now manage your GPOs.

But you can still edit the production GPOs through GPMC, mostly Domain admins.
There are ways to remove that right but it can be reversed (https://blogs.technet.com/b/askds/archive/2011/06/21/forcing-domain-admins-to-use-agpm-but-not-really.aspx)
So in the end only Education of your administrator will work.

This "issue" can introduce divergence between the version in production and the one in AGPM.
This could lead to settings in production being lost when a GPO that was modified in AGPM is deployed.

The script I am presenting you will help identify those GPOs that have been modified outside of AGPM and prevent possible loss of setting.

It is based on 2 powershell cmdlet:

Get-controlledGPO: New cmdlet provided with AGPM 4.0 SP3 that list all GPOs managed by AGPM. Meaning that a copy of the GPO is in the AGPM Archive.
Get-GPO: classic GPO cmdlet that list all GPOs in a domain.

Based on the different dates and version number provided by the cmdlets, we can now have an idea of the status of GPOs managed by AGPM.

Controlled: with a value of Yes or No will let you know if the GPO is controlled by AGPM.

Version status: Values can be

"AGPM version in production": same GPO in production and in AGPM (all is good)
"New AGPM version not in production": the GPO is being modified in AGPM. Next step would be to by deployed in production. So check the modification date to see if it is a recent change or a GPO that was not put in production.
" Modified in GPMC": You need to check this GPO as it has been modified outside of AGPM.

This is a first version of the script and it has only been written to work on the current domain. I have not yet tested with an AGPM that contains multiple domains, even if this is not a recommended configuration it can be found.

As usual let me know your thoughts and suggestions on this script.

Script can be found here

AGPM Quick Configuration Script

Thomas Bouchereau (PFE) — Mon, 23 Jun 2014 02:16:00 GMT

It’s been a while since I posted anything here, but I’m back and I have a few things to share.

Today it’s about AGPM (Advanced Group Policy Management).
I’m a not going to get into details on how AGPM works, there are plenty of other blogs about the subject.

I regularly go onsite to clients to help them set up AGPM in their environment and when installing AGPM you always want to have this article in mind from the Ask Directory Services Team on how to set AGPM with least privilege (here).
After a few half dozen times, I started thinking about automating these tasks.

So here is a powershell script that I use to quickly prepare the environment for the installation of AGPM.

In details what it does is:

1) Create an OU where all AGPM accounts and Groups will be stored

2) Create the AGPM service account with a never expiring password (you are prompted to manually enter that password)

3) Add the AGPM service account to the groups “Backup Operator” and “Group Policy Creator owners”

4) Create the AGPM Full admin account (you are prompted to manually enter the password)

5) Create an “AGPM_Admin” group and add the AGPM Full admin account to it. This groups can then later be delegated the full admin role in AGPM

6) Create an “AGPM_Approver” group. This Group can later be delegated the Approver role in AGPM

7) Create an “AGPM Editor” group. This group can later be delegated the Editor role in AGPM

8) Create an “AGPM Reviewer” group. This group can later be delegated the Reviewer role in AGPM

9) Give full control on all existing GPOs to the AGPM Service Account

10) Give the “Read Gplink” and “Write gplink” extended rights to the root of the OU structure to the AGPM Service account

However to be in line with the Least Privilege article, you will have to manually give Full control to the AGPM Archive folder and Temp folder to the AGPM service account on the AGPM server, once AGPM is installed.

You can download the script here

I give this script as is and you can modify it as much as you want.
There is no requirements for groups to install AGPM, as well as the OU to store the groups and users. This is just a habit I have.

The main tasks you want to keep if you want to customize it are:

1) Create the AGPM service account

2) Create the Full admin account (even this one is optional)

3) Add the AGPM service account to the groups “Backup Operator” and “Group Policy Creator Owners”

4) Give full control on all existing GPOs to the AGPM service account

5) Give the “Read Gplink” and “Write gplink” extended rights to the root of the OU structure to the AGPM Service account

As usual let me know your inputs.

Thomas

Group Policy Links Backup and Restore functions

Thomas Bouchereau (PFE) — Thu, 20 Feb 2014 04:37:00 GMT

Updated on 2/20/2014:

restore-gplink function was updated to incorporate cases that were not included at first.

===================================

A few months back, I put together a function that allowed me to collect the GPLinks information on targeted OUs and sites.
In the post it was also explained how you could run that function on an OU structure to create a global GPlink backup file.

Only I recently thought that I would be more useful to be able to target a GPO and backup the location of where it is linked.
And of course once you have the backup you will want to be able to restore it.

Dependencies:

Those new functions (at least the backup one) will need you to use the “get-gplink” function I have created.

The main reason is the format that I have used to export information on the status of the links.

As you can see, I return the values as “yes” and “no”.

Using the get-gpinheritance it returns “True” and “False”

The problem is that the cmdlet “new-gplink” or “set-gplink” , when it comes to the switches, expects a value of “yes” and “no”

So because I do not want to have to manipulate those ouputs, I simply use my function.
By the way, this was why I set the output of my function to use “yes” and “no” from the start.

Backup-gplink function

The best way I know of getting where a GPO is linked (besides using GPMC) is to look at a GPO report.
With Powershell you can get that report with a simple line:

What we are interested in is the “links” part of the report as it contains the information we are looking for. Be careful as it only includes the links of the GPO in its own domain.

Now HTML is fine for viewing but not for parsing.

We can change the output of the get-gpreport to export in xml and we can even load that output into a variable.

The [xml] at the beginning of the line is to declare the type of the variable $xml. Basically we have declared that the content of the variable is in xml format.

Now what can we do with that variable… Well navigate its content of course.

We now have a format that we can manipulate and we have almost all the information we need, we are only missing the link order… and that is a shame.
That is where we need to use the get-gpink to collect that information.
So out of that report I am only interested in the SOMPath that will contain all the locations where the GPO is linked.

Once you have registered the functions by “dotnetting” the script I have provide, you will be able to use the function “Backup-gplink”.

The function has two parameters:

Gponame: the name of the GPO you want to backup the gplinks
path: path to where you want to save the backup file. (in this example the variable $pwd indicate the location of my prompt “C:\Users\Administrator\Documents” )

The output is a simple csv file, name _gplinksbackup.csv that you can later see and manipulate.

Restore-gplink

Once you have that backup, you might want to use it to restore a gpo gplinks.
That function is very simple and has only one input and a switch

It will consume the content of the CSV file and use either the cmdlet “new-gplink” to link the GPO to the location where they were previously linked or if already linked “set-gplink” to re-apply
the configuration that was in the backup (in case it was changed).

So you have your GPO linked:

After an error (human or else..) the links are gone:

Run the above command

The links will be restored but with a disabled state. The idea is to prevent restoring a GPO link that would impact the production.
You will manually have to enable the link again to make it effective.

The script will change the link order from the one in the backup if there is not the same number of links on the SOM or if the retsored gplink is the only one and add an order different then 1 in the backup.

If the GPO is still linked at the same location the script will not by default, chnage tha value of the link

However if you want to force the values that are in the backup file, you can use the -force switch:

Backupgpofull

Here is a quick and dirty way of planning a daily backup of your GPOs with their GPLinks. This script will remove content that is older than a day and do a backup of the GPO
and the GPOs Links.

get-childitem -Path $pwd\bck | where-object {$_.LastAccessTime -le (get-date).adddays(-1)} |foreach { Remove-Item -Path $pwd\bck\$_ -force -Recurse}

get-gpo -all | foreach {

Backup-GPO -name $_.displayname -Path $pwd\bck

backup-gplink -gponame $_.displayname -path $pwd\bck

}

Restoregpofull

Based on that output you could use the following code to restore your backup and their gplinks

$directories=Get-ChildItem -Path $pwd\bck -Directory

$files=Get-ChildItem -Path $pwd\bck -File

foreach ($d in $directories)

{

Restore-GPO -BackupId $d.name -Path $pwd\bck

}

foreach ($f in $files)

{

restore-gplink -path $pwd\bck\$($f.Name)

As usual hope you find this useful in your daily work and please give we feedback on this.

Script can be found here

Group Policy processing events collection with Powershell

Thomas Bouchereau (PFE) — Wed, 30 Oct 2013 07:19:00 GMT

Updated: 02/05/2014

The script has been optimized thanks for my colleague Pierre Audonnet.
You can also now export to csv and html format.

=============================================================

When troubleshooting GPO processing we have a lot of tools available to us.
Since Windows Vista, we especially have a new Event Log that register all events related to GPO processing.

One "new" feature is that each GPO event is assigned an Activity ID that is unique for a GPO processing.

Tools such as GPlogview can use that Activity ID to sort large event logs and focus on a specific GPO processing.

You can also create a custom event log view to sort them using the following "Query":

More details in the following article: https://technet.microsoft.com/en-us/library/cc749336(v=WS.10).aspx

Problems with those tools are that:

You need to have GPLogView already installed on a computer to collect locally or remotely. You also need to know the Activity ID corresponding to the GPO processing you want to analyze.
If using the Custom Log view, you need to either export the log on your computer or create the custom log view on the computer you want to analyse.

What about if you could list the lasted Activity IDs log on a computer and then sort only those events corresponding to these Activity ID.

That was the starting point of this little project.

Getgpoprocessing.ps1

An Activity ID is assigned at each new GPO processing. As you might know there is eight events that will trigger a new GPO processing:

Computer Boot
User Logon
Computer background refresh
User background refresh
Computer Network Change
User Network Change
Computer Manual Update
User Manual Update

Each of those event is logged in the group policy event log with a specific event ID:

Computer Boot: event ID 4000
User Logon: event ID 4001
Computer Background Refresh: event ID 4006
User Background Refresh: event ID 4007
Computer Network Change: event 4002
User Network Change: event 4003
Computer Manual Update: event 4004
User Manual Update: event 4005

To access the Group Policy event log, you can use the powershell cmdlet: get-winevent

So what my script does is simple:

Collect the group policy events over a period of hours that you specify on a local or remote computer
Display the events corresponding to a new GPO processing
Have you select the one you are interested in and gives you all corresponding events base on the Activity ID.

Here is an example:

Getgpoprocessing –hours 2

Here you can see that we have a periodic policy refresh for the computer every 5 minutes. This is normal as it is collected on a DC.

The same command to collect on a remote member server:

Getgpoprocessing –hours 2 –computer 2012MS

Once you have the "Starting" events, all you need is to enter the number of the one you want to review.

Following the collection on member server 2012MS, I will select 1 to review the background User GPO processing for user "Administrator" with Activity ID {7B27C738-6A05-40A2-8187-A0D97111182D}

I now have the list of events from the Group Policy event log of member server 2012MS, with Activity ID {7B27C738-6A05-40A2-8187-A0D97111182D}.
The script only display the LevelDisplayName (Information, Warning, Error) and the message in the event.

You can also chosse to export the results to csv or html or both by adding the -csv $true or -html $true switches

The file name format are:

--gpoprocessing.csv

--gpoprocessing.html

If you do not specify a computer, meaning you run the script locally the is replaced by "LocalHost"

Requirements:

I order to use this script, you will need to have access to the Event logs, locally or remotely.

As usual you can find the script here

Get-GPlink function V1.3

Thomas Bouchereau (PFE) — Fri, 11 Oct 2013 05:45:00 GMT

Hi all

As promised I return to you with an updated version of my function get-gplink.
Here is the list of what is changed from version 1.0:

New set of switches:

-path: DN of the object you want to get the gplink information
-site: Just to indicate that you are running the command against a site object. This will change the internal process to target the Configuration partition.
- server: if you are running the command from a domain that is different from the target domain of your command, you will need to specify a DC of that target domain

Compatibility with .NET 3.5:

Turns out that version 1.0 was using some code that only .NET4 could handle.

New information returned:

If you recall version 1.0 could not return information about a GPO originating from a different domain and was returned the same as an "Orphaned Gplink".
Version 1.3 can now get that information and also return the originating domain of the GPO.
This means that anything that is reported as "Orphaned Gplink" is now a real orphaned.

To register that new version of get-gplink just run the command ". .\get-gplink_v1.3.ps1"
It will replace the get-gplink you might have been using.

Check the get-help of the function. I have changed a bit the output. Instead of "path", you get "Target" and "GPOGUID" has been changed into "gpoid" and"GPOName" to "DisplayName".This is to aligned with the "set-gplink" and "new-gplink" cmdlets.

Get Gplink on the OU "domain controllers" of contoso.com

Get gplink on the OU "domain controllers" of domain child.contoso.com

Get gplink on Site "Site1"

Bonus:

So, while I was working on improving my code, I spent time looking into what the cmdlet "get-gpinheritance" could do.. and guess what, it can actually do most of what my code does.

I say most of because while it is on average faster than my code (I could probably improve that), it does not give all the information I found relevant to gplinks.

Here is an example:

I have GPOs linked at the OU "Domain Controllers"

As you can see one of them is an Orphaned Gplink and the others are normal GPos.

The command you can use with get-gpinheritance is this one:

And here is the result:

As you can see, we have the order, the Enabled, Enforced, GPOID and name. As expected we have one GPO with no name as it is an Orphaned Gplink

Now here is what you get when you use my code:

You still get the same order, Enforced and Enabled status, but you also get more information:

Instead of a blank name you get "orphaned-gplink". A bit more explicite than a "blank" space
If you look closely at the "GHC_U_Disabled_GPO_Test_1" GPO, you will noticed that it is not a GPO from "contoso.com" but from the domain "child.contoso.com"

The fact that I don't have those information with the get-gpinheritance makes it hard to use that command in some cases.
As an example, I would have found it very useful to help me backup that order information and backup the GPO at the same time, but because I do not have the "originating" domain, I cannot use the output to pipe it to a "backup-gpo" cmdlet.

Also if you look at the command "set-gplink", it can manage linking GPOs from a remote domain by using the switch "domain". The output my code provides can simply be re-used entirely by the "set-gplink".

One other thing that you can get with the get-gpinheritance cmdlet is the gpo inheritance (make sense no?)

So the almost same command

will give you this

I have not implemented that in my code and probably won't.

However the get-inheritance cmdlet does not work on the Configuration partition and will not report Site linked GPOs.

Conclusion:

Instead of a simple update to my code, this time I will provide you with 2 bits of code:

Get-gplink_V1.3.ps1:

My code that gives a bit more information on the GPO links.

Get-gplink_SD.ps1 (SD as in single domain):

A much simpler version of the function that is in fact derived from the get-gpinheritance

You can find them here

DFSR-SYSVOL Authoritative / Non-Authoritative Restore Powershell Functions

Thomas Bouchereau (PFE) — Wed, 28 Aug 2013 05:19:00 GMT

Hi folks,

For this new post we are going to talk about DFSR replication SYSVOL restore.
You might be familiar with the following KB that explains the process of doing "D4/D2" like restore for SYSVOL when replicated over DFSR : https://support.microsoft.com/kb/2218556

Basically instead of having to configure registry keys like with FRS, you now need to change AD attributes to trigger either non-authoritative or authoritative restore of SYSVOL.

The attributes belong to the following object (one for each DC replication SYSVOL)

CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=,OU=Domain Controllers,DC=

They are msdfsr-Enabled and msdfsr-options

The above KB recommend ADSIEDIT.MSC to modify those values and its fine if you have a small number of DCs to manage.

But being a proper AD admin, even 3 DCs is a large number for me.. and especially if you happen to have to do that procedure on Windows 2008R2 Core..during a disaster recovery procedure… No don't look around ADSIEDIT is not there…

It's from that experience that I decided to create some new powershell functions to help me ( and now you too) with this kind of situation.

So what are those functions?

There are 3 of them:

Get-SysvolDFSRconf

Pretty straight forward, it will simply give you the values of the attributes "msdfsr-Enabled" and "msdfsr-options" on the server you will specify

Set-nonauthDFSRsysvol:

This function will allow you to set the values for the attribute msdfsr-Enable like explained in the chapter "How to perform a non-authoritative synchronization of DFSR Replicated SYSVOL"

There is a switch called "step" that can take the values 1 or 2.

The first command you need to run is:

Set-nonauthDFSRSysvol –server -step 1

It will set the attribute of the specified server to FALSE (Step 1 of the KB procedure)

The second command you will have to run is:

Set-nonauthDFSRSysvol –server -step 2

It will set the attribute of the specified server to TRUE (Step 5 of the KB procedure)

I have not integrated the DFSRDIAG POLLAD in the function as I wanted to keep things separated.
If you want to run it on a remote server you can use the following command:

Dfsrdiag pollad /member:DOMAIN\servername

You can easily combine that function with a foreach loop that will contain all the DC you want to set as non-authoritative in the case of a global SYSVOL restore (step 11 of the chapter How to perform a authoritative synchronization of DFSR Replicated SYSVOL")

Set-authDFSRSysvol:

This function will allow you to set the values for the attribute msdfsr-Enable and msdfsr-Options like explained in the chapter "How to perform a authoritative synchronization of DFSR Replicated SYSVOL"

There is a switch called "step" that can take the values 1 or 2.

The first command you need to run is:

Set-authDFSRSysvol –server -step 1

It will set the attribute msdfsr-Enabled of the specified server to FALSE and the attribute msdfsr-options to 1 (Step 1 of the KB procedure)

The second command you will have to run is:

Set-authDFSRSysvol –server -step 2

It will set the attribute msdfsr-Enabled of the specified server to TRUE (Step 6 of the KB procedure)

I have not integrated the DFSRDIAG POLLAD in the function as I wanted to keep things separated.
If you want to run it on a remote server you can use the following command:

Dfsrdiag pollad /member:DOMAIN\servername

You can download the PS script with the functions here.
You will need to "dot" it to register the functions in your environment.

Hope you find those useful in any of your SYSVOL restore operations and please give me feedback.

Get-GpLink function and GpLink backup

Thomas Bouchereau (PFE) — Wed, 10 Jul 2013 08:21:00 GMT

Hi all,

Who hasn't been dreaming of a get-gplink cmdlet? How would it be so simple to run a command and get the list of GPOs links to a site, OU or domain DN?

We could be doing so much with a simple "get-gplink".

I recently was at a client where I was performing remediation following a Group Policy Health I did a year ago and where the client had not time to do it himself.
When I left, 12 month ago, I gave him a list of the GPOs that were linked to its domain and the state of the links. But I wasn't able to do it now, as it was done using the Group Policy Health Check tool.

So I took upon myself to create the missing "get-glink" and I am now happy to share it with you.

I have built it so that it produces objects that can be used by the existing cmdlets related to gplink:

new-gplink
set-gplink
remove-gplink

In order to use it, you first have to register it to your environment. You can do this by simply executing the script with no parameter .\get-gplink.ps1

Run the command dir function:\ and verify that get-gplink is registed

Listing link GPO on an object:

Running the command get-help get-gplink –detailed will give you details on how to use the command.

Here is what an output looks like:

The same one returned in a table format:

Path: returns the DN of the object you run the command against
GPOGUID: returns the GUID of the GPO linked
GPOName: returns the friendly name of the GPO
Enforced: Returns whether the GPO link is enforce or not
Enabled: returns whether the GPO link is enabled or not
Order: return the link order

If the GPOGUID cannot be found in the domain, the GPO name is replaced by "Orphaned GPLink or External GPO". This version of get-gplink does not verify the GUID in other domains of the forest. This will be for a future version. So a unknow GUID can be either an "External GPO" or an "Orphaned GPLINK"

An Orphaned GPLINK is a gplink that is pointing to a missing GPC (group policy container).

This is how it looks like in GPMC:

Exporting to CSV:

Now the nice part about it is that you can simply export the results to a CSV file:

What could you then do with that CSV file…

How about restoring deleted gplinks?

Restoring deleted links and link order:

This is what I have exported in my csv:

I now delete my links:

Since I exported the links in the csv file, I can simply run the following command to restore them:

My links have been restored in the proper order and with the proper options:

And now the "plat de résistance"…

Group Policy Disaster Recovery:

You got it, this export is actually also a backup of sort.

So with some little PS scripting here is how on top of doing a backup of all you domain gpo, you can do the same with your GPO links.

I won't explain how to use backup-gpo and restore-gpo to backup and restored GPOs in your domain. But simply give you the command that you can add now to be able to simply restore those links:

Get-adobject –filter {(objectclass –eq "domaindns") –or (objectclass –eq "organizationalunit")} | foreach {get-gplink –path $_} | export-csv "gplink.all"

You now have a "backup" of all your domain gplinks.

Limitations:

This is just the first version of get-gplink. I plan you adding other functions such as reporting external linked GPOs and running the command against Sites as well. Stay tune for the updates.

You can find the script here