GPO scripting

---

Hi,

I am looking for a powershell script that will enable me to extract a large number of GPO's that have been linked under an OU. I need to see the settings of each of the GPO's so I can check them for security compliance.

I raised the question during the GPO show on 11-12-2015 @Mike Rodrick

Solution #1 (separate lines in PowerShell or ISE)

$gpos = Get-GPO -all | select displayname
foreach ($g in $gpos) {
Get-GPOReport -ReportType Html -Name $g.displayname -Path C:\reports\$g.html

This script generates individual reports for all GPOs in the domain.

Solution #2 (all on one line)

(Get-GPInheritance -Target "ou=developers,ou=gnv,ou=employees,dc=lab,dc=itpro,dc=tv").GpoLinks | ForEach-Object {Get-GPOReport -ReportType Html -Name ($_.displayname) -Path (Join-Path C:\Reports\ $_.displayname)} 

This script generates individual reports for GPOs directly linked to the OU specified with the -target parameter.

Solution #3 (all on one line)

(Get-GPInheritance -Target "ou=developers,ou=gnv,ou=employees,dc=lab,dc=itpro,dc=tv").InheritedGpoLinks | ForEach-Object {Get-GPOReport -ReportType Html -Name ($_.displayname) -Path (Join-Path C:\Reports\ $_.displayname)} 

This script generates individual reports for GPOs directly linked to and inherited by the OU specified with the -target parameter.

Make sure to change the -target parameter and the -path parameter for your environment.

With the last two solutions, the generated reports do not include a file extension. They are html files, and you can open them with your browser. Everything I tried to add the file extension broke the script :confounded:

How about another script that renames the reports, :)

Mike,

Probably a dirty way to append the extension of examples 2 and 3:

Sorry don't know the code tags

$GPO = Get-GPInheritance -Target "OU=Users,OU=London,DC=contoso,DC=com"

foreach ($i in $GPO.InheritedGpoLinks)
{
$name = "C:\Reports"+ $i.displayname + ".html"

Get-GPOReport -ReportType Html -Name $i.displayname -Path $name
}