Previously we have gone through the process of creating a Group Policy Object, and importing a backed up GPO into the directory. In this post we’ll take a look at linking our GPO to an OU.

We will use the GPO from the previous examples: “New GPO Test”, and we will link it to the Domain Controllers OU.

As usual, we start by creating a reference to the domain ($root), instantiating the GPMC COM object ($gpm), and by binding to the domain through GPMC ($domain).

After searching AD for a policy called New GPO Test, we check to see if we have found a match by looking at $GPOlist.count. We have only found one here so we have no problems to proceed.

The $SOM object refers to the Scope of Management, which is where we specify our target for the link. The -1 refers to the link order, which in this example will append our GPO to the end of the list.

Here we have the available methods on the GPMlink object, in particular we can set the enforcement of the policy. In the example above we can see that the newly linked policy has a link order of 3 showing us that there are 2 other policies linked to the Domain Controllers OU.

There’s a lot of automated administration that we can apply to Group Policies through the GPMC COM object and PowerShell. For more ideas I’d recommend checking out the scripts provided with GPMC, and the GPMC object model

#———————————————————————————————————-
function Create-GPOLink
#———————————————————————————————————-
# Depends on Convert-DNtoFQDN function from Code Samples Page
{
Param (
$GPOname,
[int]$GPOlinkPos,
$DSlocation
)
# Make the connection to the domain through GPMC COM
$domain = $gpm.GetDomain( (Convert-DNtoFQDN $root.distinguishedName[0]), $null, $gpm.GetConstants().UseAnyDC )

# Build a GPMC search object to locate the GPO (in both the backup directory and AD)
$searcher = $gpm.CreateSearchCriteria()
$searcher.Add( $gpm.GetConstants().SearchPropertyGPODisplayName, `
$gpm.GetConstants().SearchOpEquals, $GPOname )

$GPOlist = $domain.SearchGPOs( $searcher )
# This would be a good place to check that our GPOlist.count is as desired!

#Define our Scope Of Management (SoM)
$SOM = $domain.GetSOM( $DSlocation “,”+$root.distinguishedName)

# Create the actual link
$GPMlink = $SOM.CreateGPOLink( $GPOlinkPos, $GPOlist.Item(1) )
}
# Sample calling:
Create-GPOlink “New GPO Test” -1 “ou=domain controllers”