I’ll write up the meeting soon.

[Updated 27 Nov 2007]

I’ve put the presentation inside a zip file. This should resolve any issues. Please let me know ..

Any comments on either the night, or the attached PowerPoint are welcome ….
Group Policy Management with PowerShell

Apologies for the poor homage. I couldn’t help myself ;)

The PowerShell Team have released a CTP of 2.0.

Skype have released Beta 2.0 for Linux (finally bringing video!)

SDM Software have released a set of free cmdlets full of GPO goodness!

And even though it wasn’t technically this week, Microsoft’s Deployment4, was officially named Microsoft Deployment, and went to RC1.

This situation is very similar to when the Windows Installer (MSI) technology first came on to the scene around 2000-2001, and anyone authoring setup software was dealing with how to get it out into their environments. Everyone was including the redistributable with their software in case the machine it was going to be installed on didn’t have it in place already.

The complexity with PowerShell however is that there are two questions that need to be dealt with:1) Like MSI, how do you deploy PowerShell out in your environment? and 2) How do you manage your PowerShell landscape of Snappins?

I was lucky enough see an online demo from Magnus and Thorbjorn from Special Operations Software today. They have a new product expected to be announced at TechEd later this month, called SpecOps Command which I believe will deal with these questions, for starters.

SpecOps Command, seems to be a tightly integrated product between Group Policy and PowerShell. This combination has the ability to provide it with the best of both products: the ease and flexibility of PowerShell, and the centralised environment management of Group Policy.

The tool has loads of cool features including the ability to run PoSH scripts assigned in GPO’s, Undo scripts for when things fall out of scope, reporting, and the ability to target clients in a very granular manner e.g. Only apply to Dell machines running Windows XP.

Thorbjorn advised that SpecOps intend to release a couple of versions of Command, including a free version that should provide the core functionality including the abilty to distribute PowerShell out into your environment.

I think it’s great that ISV’s like Quest and SpecOps are adding value to the PowerShell community with free offerings, as well as their commercial products. It give them exposure to their intended market, and provides us with some cool tools to make life easier :)

Like Quest’s AD Cmdlet’s I think SpecOps Command is likely to have a big impact on the way we use PowerShell going forwards.

[Update 2 Nov]
Magnus just gave me the link to the SpecOps website for Command. This will be the product page when it releases.

The toolkit is accessed as a PowerShell Snapin, and can make changes to the following GPO branches:

In this example, we’re going to make a change to the Max password age located within the Account Policies / Password Policy branch.

This is a shot of the Default Domain Policy with the default Password Policy settings. We’re going to change the Max password age setting from 24 to 7 because we like to make users lives difficult ;)

[Note] The blank spaces in the following pictures are where I’ve had to remove the domain name. This should be in FQDN format: MyDomain.tld

A quick check in GPMC, confirms that the setting has changed.

Walking through the code, we can see how easy it is.

We add the snapin to the Shell so that we can use the GPO cmdlets.
The second line binds to the GPO we are going to change.

If we perform a Get-Method on the $gpo object we get an insight into some of the methods we have access to:

Here we create the $setting object to the setting we wish to change.

Using the Put() method we change the attributes to what’s required. This is a similar way that certain AD attributes are modified too.

We’ll be having a look at other settings and methods that can be changed through these cmdlets soon. In the mean time here’s the completed code snippet:
Set-MaxPwdAge

Well today I stumbled across GPExpert™ Scripting Toolkit for PowerShell. This product apparently exposes GPO settings to PowerShell, allowing specific changes to be made, rather than importing backed up GP objects.

I’ve not had the opportunity to take it for a test drive yet, but I do have an eval version and will be having a closer look later this week.I’ll let you know how it shapes up.

We will use the GPO from the previous examples: “New GPO Test”, and we will link it to the Domain Controllers OU.

As usual, we start by creating a reference to the domain ($root), instantiating the GPMC COM object ($gpm), and by binding to the domain through GPMC ($domain).

After searching AD for a policy called New GPO Test, we check to see if we have found a match by looking at $GPOlist.count. We have only found one here so we have no problems to proceed.

The $SOM object refers to the Scope of Management, which is where we specify our target for the link. The -1 refers to the link order, which in this example will append our GPO to the end of the list.

Here we have the available methods on the GPMlink object, in particular we can set the enforcement of the policy. In the example above we can see that the newly linked policy has a link order of 3 showing us that there are 2 other policies linked to the Domain Controllers OU.

There’s a lot of automated administration that we can apply to Group Policies through the GPMC COM object and PowerShell. For more ideas I’d recommend checking out the scripts provided with GPMC, and the GPMC object model

create-gpolink

There’s also some nice code examples included! Well worth a look!

This time I thought we’d take a look at the next step of importing a GPO into our newly created policy.

The general principle behind this is that you import a policy that has been backed up using GPMC previously. If the policy is not from the same domain as the one you’re importing into, then any domain specific data such as SID’s will need to be dealt with using a Migration Table.

In our example though, we will simply be importing a GPO that was exported through right-clicking the Group Policy Objects container and stepping through the back up wizard.

Just like when we created a new GPO, we search the AD to see if we can find a GPO matching our displayName. This time a match is what we are looking for. We also use the same $searcher object to search the backup directory for a matching policy.

Important to note here that we have exactly one match returned in each of the two searches.

Selecting $GPOlist.Item(1) gives you an idea how you can reference different policies located in the previous search. The list of methods (gm) available also gives you an idea of the type of things you can do with it. We are interested in the Import() method.

As you can see with the $Result object, we can verify that the policy was successful. And checking with GPMC:

Microsoft provide a good set of example scripts located in the Scripts folder in the GPMC install directory. There is also a pretty decent help file (CHM format). Both the help and samples are well worth a look.

Through the COM object we can perform any of the management tasks in PowerShell that can be done in VBScript or JScript etc.

We instantiate the object, and after binding to the Directory, search for any GPO’s that match our displayName of “New GPO Test”. Receiving a count of 0 shows us that no conflict will occur. You can actually have two GPO’s with the same displayName, but this would just add a level of confusion in your environment that you just don’t need!

You might notice that I have a function dot sourced in my profile here: ConvertDNtoFQDN. This allows me to dynamically lookup data and change the format as needed.

GPMC shows what a new GPO looks like.At this stage it is just an empty GPO, with no attributes set.

The commands to create the object. We can also see the methods and property’s available to the GPO object. And then finally we set the displayName.

GPMC shows our updated object with the displayName configured.

For the GPO to become useful, at a minimum, we would need to actually import settings and link it to the directory.

I am not aware of any programmatic method of actually configuring settings at the moment. What I have personally seen is people exporting backup of the GPO’s from a reference system, and then importing them into the target environment using a Migration Table to handle any domain specific references.

Below is a sample function to create a new GPO.
Create-NewGPO.ps1