In this post we’re going to take a look at changing some basic Group Policy Settings through the GPexpert Scripting Toolkit.

The toolkit is accessed as a PowerShell Snapin, and can make changes to the following GPO branches:

In this example, we’re going to make a change to the Max password age located within the Account Policies / Password Policy branch.

This is a shot of the Default Domain Policy with the default Password Policy settings. We’re going to change the Max password age setting from 24 to 7 because we like to make users lives difficult ;)

[Note] The blank spaces in the following pictures are where I’ve had to remove the domain name. This should be in FQDN format: MyDomain.tld

A quick check in GPMC, confirms that the setting has changed.

Walking through the code, we can see how easy it is.

Add-PSSnapin GetGPOObjectPSSnapin
$gpo = Get-SDMgpobject -gpoName “gpo://example.com/Default Domain Policy” -openByName $true;

We add the snapin to the Shell so that we can use the GPO cmdlets.
The second line binds to the GPO we are going to change.

If we perform a Get-Method on the $gpo object we get an insight into some of the methods we have access to:

Here we create the $setting object to the setting we wish to change.

$setting = $gpo.GetObject(“Computer Configuration/Windows Settings/Security Settings/Account Policies/Password Policy/Maximum password age”);

Using the Put() method we change the attributes to what’s required. This is a similar way that certain AD attributes are modified too.

$setting.Put(“Defined”, $true);
$setting.Put(“Value”, 7);
$setting.Save();

We’ll be having a look at other settings and methods that can be changed through these cmdlets soon. In the mean time here’s the completed code snippet:

Add-PSSnapin GetGPOObjectPSSnapin

$gpo = Get-SDMgpobject -gpoName “gpo://example.com/Default Domain Policy” -openByName $true;
$setting = $gpo.GetObject(“Computer Configuration/Windows Settings/Security Settings/Account Policies/Password Policy/Maximum password age”);
$setting.Put(“Defined”, $true);
$setting.Put(“Value”, 7);
$setting.Save();