PowerShell Script: GPO replication status across Domain Controller

Helloooo !!

A colleague asked me to create a PS script to check for a given GPO its AD and Sysvol versions across all Domain Controllers.

So I wrote this script that utilize the ActiveDirectory and GroupPolicy Module.

Depending on the size of your domain it can take a couple of minutes to contact each DC and retrieve the info, so launch it and go for a coffee or something...

In the same fashion as for the script from my last post, we will again be using a system object to collect all of the data together, which gives you the option to pipe it nicely to display the data or create CSV reports.
So here we go:

What the script does: 

This script takes the name of the GPO you want to check the replication status as an argument. 

It then uses the get-addomaincontroller  cmdlet from the ActiveDirectory Module to gather a list of all domain controllers host name to query. 

The retrieval of the versions on each DC is done using the Get-GPO cmdlet with -server option.

All of it is then wacked into a System.Object which is output at the end of the process. 

It is assumed that the ActiveDirectory and GroupPolicy modules are already imported in your session and that you have set the ExecutionPolicy properly on your system beforehand so that you can run the script locally.

How it works: 

Here are a few syntax example to use the script. 

& Get-GPOReplicationReport.ps1 "My GPO Name_v1.5" | Out-GridView

      The script creates a report for the specified GPO and display it in the out.GridView window.

& Get-GPOReplicationReport.ps1 "My GPO Name_v1.5" | ConverTo-Csv -Delimiter ','

      The script creates a report for the specified GPO and display it in the powershell host window as a comma delimited string (for copy and paste) .

& Get-GPOReplicationReport.ps1 "My GPO Name_v1.5" |  Export-Csv -Delimiter ',' -Path C:\MyGPOReplicationReport.csv
      The script creates a report for the specified GPO and save it as a CSV file.

Download Link:

https://drive.google.com/file/d/0B3ED4HUGG162V2FQcXJTSW03Rk0/edit?usp=sharing

Script Content:

#Created by toussman@gmail.com on 17/01/2014 

#http://theplatformadmin.blogspot.co.uk/

param(

  [parameter(Mandatory = $TRue )][String]$GPOName

 )

$DCList = (get-addomaincontroller -filter *).hostname 

$colGPOVer = @()

foreach ($DC in $DCList){

$objGPOVers = New-Object System.Object

$GPOObj = Get-GPO $GPOName -server $DC

$UserVersion = [string]$GPOObj.User.DSVersion + ' (AD), ' + [string]$GPOObj.User.SysvolVersion + ' (sysvol)'

$ComputerVersion = [string]$GPOObj.Computer.DSVersion + ' (AD), ' + [string]$GPOObj.Computer.SysvolVersion + ' (sysvol)'

$objGPOVers | Add-Member -type noteproperty -name GPOName -value $GPOName

$objGPOVers | Add-Member -type noteproperty -name DCName -value $DC

$objGPOVers | Add-Member -type noteproperty -name UserVersion -value $UserVersion

$objGPOVers | Add-Member -type noteproperty -name ComputerVersion -value $ComputerVersion

$colGPOVer += $objGPOVers 

}

$colGPOVer | sort-object GPOName, DCName

Well, that's it for this post. 

I hope you will find the script useful and if you have any suggestions or spot something that can be improved leave me a comment to let me know. 

Until next time !! 

PowerShell Script: HouseKeeping GPO Report

Hello there !! 

My first post for 2014 is going to be about a Powershell script I just created to produce a GPO Report to keep track of the environment and also list GPOs for housekeeping tasks such as listing all the GPOs without WMIfilter, all the GPOs linked to a particular OU, ...

None of the GroupPolicy cmdlets that come with the GroupPolicy Module in RSAT actually allowed me to produce an all in one report based on the actual object configuration (i.e.: OU Linked, WMI filter applied, Security filtering, ... ).

It is assumed that you have imported the GroupPolicy module and that you have set the ExecutionPolicy properly on your system beforehand so that you can run the script locally.

What the script does: 

The script gets a specified list or all of the GPO in a domain and returns the following list of properties per GPO and per OU Link:
GPOName, LinksPath, WmiFilter, CreatedTime, ModifiedTime, ComputerRevisionsAD, ComputerRevisionsSYSVOL, UserRevisionsAD, UserRevisionsSYSVOL, ComputerSettingsEnabled, UserSettingsEnabled, SecurityFilter.

In other words if a GPO is linked to more than one OU it will appear once per OU where it is linked in the report. That is the same as the GPMC display tree view.

The report focuses on what is actually in effect on the domain, therefore:
- Links that are not enabled are discarded automatically.
- Security filtering for groups, users and computers that have been deleted from the domain but are still showing as SID in the GPO are skipped and not showing the report.

How it works: 

Here are a few syntax example to use the script. 

& Get-GPOReport.ps1 -All | Out-GridView

      The script creates a report for all the GPOs on the domain.

& Get-GPOReport.ps1 -GPOList  GPOName1,GPOName2,GPOName3 | ConverTo-Csv -Delimiter ','

      The script creates a report for the specified GPO.

$a = Get-Content C:\MyListOfGPOs.txt 
& Get-GPOReport.ps1 -GPOList $a | Export-Csv -Delimiter ',' -Path C:\MyGPOReport.csv
      The script creates a report for the GPOs specified in C:\MyListOfGPOs.txt.

Download Link:

https://drive.google.com/file/d/0B3ED4HUGG162LTNWWGNRaENVWmc/edit?usp=sharing

Script Content:

#Created by toussman@gmail.com on 16/01/2014 

#http://theplatformadmin.blogspot.co.uk/

param(

[parameter(Mandatory = $False )][array]$GPOList,

    [parameter(Mandatory = $False )][switch]$All

)

if( $All ){$GPOList = (Get-Gpo -All).DisplayName}

If( $GPOList -eq $null){Write-Host "Specify a list of GPOs!!"; Break}

$colGPOLinks = @()

foreach ($GPOItem in $GPOList){

       

    [xml]$gpocontent = Get-GPOReport $GPOItem -ReportType xml

    $LinksPaths = $gpocontent.GPO.LinksTo | ?{$_.Enabled -eq $True} | %{$_.SOMPath}

    $Wmi = Get-GPO $GPOItem | Select-Object WmiFilter

    

    $CreatedTime = $gpocontent.GPO.CreatedTime

    $ModifiedTime = $gpocontent.GPO.ModifiedTime

    

    $CompVerDir = $gpocontent.GPO.Computer.VersionDirectory

    $CompVerSys = $gpocontent.GPO.Computer.VersionSysvol

    $CompEnabled = $gpocontent.GPO.Computer.Enabled

    

    $UserVerDir = $gpocontent.GPO.User.VersionDirectory

    $UserVerSys = $gpocontent.GPO.User.VersionSysvol

    $UserEnabled = $gpocontent.GPO.User.Enabled

    $SecurityFilter = ((Get-GPPermissions -Name $GPOItem -All | ?{$_.Permission -eq "GpoApply"}).Trustee | ?{$_.SidType -ne "Unknown"}).name -Join ','

    foreach ($LinksPath in $LinksPaths){

        $objGPOLinks = New-Object System.Object

        $objGPOLinks | Add-Member -type noteproperty -name GPOName -value $GPOItem

        $objGPOLinks | Add-Member -type noteproperty -name LinksPath -value $LinksPath

        $objGPOLinks | Add-Member -type noteproperty -name WmiFilter -value ($wmi.WmiFilter).Name

        $objGPOLinks | Add-Member -type noteproperty -name CreatedTime -value $CreatedTime

        $objGPOLinks | Add-Member -type noteproperty -name ModifiedTime -value $ModifiedTime

        $objGPOLinks | Add-Member -type noteproperty -name ComputerRevisionsAD -value $CompVerDir

        $objGPOLinks | Add-Member -type noteproperty -name ComputerRevisionsSYSVOL -value $CompVerSys

        $objGPOLinks | Add-Member -type noteproperty -name UserRevisionsAD -value $UserVerDir

        $objGPOLinks | Add-Member -type noteproperty -name UserRevisionsSYSVOL -value $UserVerSys

        $objGPOLinks | Add-Member -type noteproperty -name ComputerSettingsEnabled -value $CompEnabled

        $objGPOLinks | Add-Member -type noteproperty -name UserSettingsEnabled -value $UserEnabled

        $objGPOLinks | Add-Member -type noteproperty -name SecurityFilter -value $SecurityFilter

        $colGPOLinks += $objGPOLinks

    }

}

$colGPOLinks | sort-object GPOName, LinksPath 

Well, that's it for this post. 

I hope you will find the script useful and if you have any suggestions or spot something that can be improved (I am no PowerShell Guru) leave me a comment to let me know. 

Until next time !! 

How-To Manage the new Java security prompts without using keytool

As explained by Oracle on their web (follow this link for the full details):


"Java 7 Update 21 introduced changes to the Java browser plug-in behavior that enable you to make more informed decisions before running the Java applet in the browser. "

In the case of  "Java application with a certificate from a trusted authority" if the user checks the option "Do not show this again ... " well ... they would not get prompted again. 

Yet some administrator could still want to manage some of those prompts for their environment. For instance to prevent such prompt for their intranet applications.

To do so, you would need to: 

1. Get the URLs of the web pages throwing those warnings. 

2. On a test machine, install a version of Java that is higher than 7u21 and ensure that there is no trusted.certs file under C:\Users\<UserID>\AppData\LocalLow\Sun\Java\Deployment\security (unless you want to update an existing keystore)

3. Then browse each of the URLs you would like to pre-authorize on behalf of the users and ensure that you check the box "Do not show this again ... " and click on Run.

This will create and add the signing certificate information to the C:\Users\<UserID>\AppData\LocalLow\Sun\Java\Deployment\security\trusted.certs file.

To deploy this file you have several options, you could be using a GPO to push this file to your clients, or include it into your java package, or if java is installed in your corporate image simply copy it to the image prior to capturing it.

The file should be copied to the SYSTEM Java security folder - this way it will apply to all users. - under: 

C:\Program Files (x86)\Java\jre7\lib\security

and eventually 

C:\Program Files\Java\jre7\lib\security ( If you use 64-bit browser and 64 bit Java add-on) .

Here is a screenshot of the settings of a GPO that was tested to push the file to the clients: 

Should you want to carry on updating the keysotre file to add new applications as time passes then simply copy you existing trusted.certs file to your test machine - as per step 2 above - prior to adding more exceptions.

I have noticed when testing that the method that consists of first adding the certificate as described above and then going to the Java control panel to export the certificate as a .cer file to finally use keytool to add the signing certificate details to a keystore file did not work for me.

I have compared a working and a non-working trusted.certs file and the only difference I noticed was the Alias.  When letting java do the job of updating the trusted.certs the alias created looked like:
deploymentusercert$tsflag$loc=https//secure.entrust.com:443java.util.random@973f09
or
deploymentusercert$tsflag$loc=https//java.com:443java.util.random@a549a8

and this was the only way it would work. 

I hope you enjoy this article, until next time ... 

FIX - GPP Item-level targeting based on Active Directory group membership not working

I came across a GPO change that required Item-level Targeting based on Active Directory group membership and learned a valuable lesson.

Although the Group Policy Editor allows you to type in your group name manually i.e.: MyDomain\My_Security_GroupName, this will not work when applying the GPP to a machine or user.

Instead, you must ensure that you actually click on the "..." button to browse the domain and select the group this way. This ensures that the group SID is included in the GPO and that was how I fixed this  Item-level Targeting issue.

HOW-TO GPP Apply Once and Do Not Reapply

With Group Policy Preferences the settings "Apply Once and Do Not Reapply" can be enforced.

This is a great feature but when testing a GPP that you need to re-work and then re-test, it can be a bit annoying.

Instead of using another machine, you can clean your test machine as follow:

To know if a GPP has already been applied to a machine, the machine stores the Unique ID associated with each  "Apply Once" settings in the registry.

For USER settings the UIDs are stored under:
HKEY_CURRENT_USER\Software\Microsoft\Group Policy\Client\RunOnce

and for MACHINE settings under:
HKEY_LOCAL_MACHINE\Software\Microsoft\Group Policy\Client\RunOnce

To know which UID(s) to clear, take a backup of your GPO and search for the "FilterRunOnce" ID in the gpreport.xml file.

HOW-TO Work with Group Policy Preferences F Keys

Let's first clarify that here F stands for Function and not Fxxxing Keys.

I recently was asked why the Group Policy Preferences where applying extra Power Configuration settings to the clients than the one defined in GPP through GPEdit.

Although how to work with GPP is someting that is documented in many places on the net and also in the GPMC.CHM, the use for the Function keys it's not intuitive at all and either you know it or you don't.

Here is the gist of it, when working with GPP some of the settings appears in the GUI underlined in Green or Red. The color  is actually a code to indicate which setting's value will be applied by the GPP and which won't.

As far as I could check in my lab this is true for the following GPP items:
-  Folder Options
- Internet Settings
- Power Options
- Regional Options
- Start Menu

To swtich between enabled and disabled here are the keys: