Getting Started with GPMC Scripting

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Learning to write GPMC scripts is fairly straightforward. All GPMC scripts that you write will follow the same basic steps. As with most new objects that you use in the WSH environment, you first need to create instances of, or instantiate, the objects you want to use. In all GPMC scripts, the first object you need to instantiate is the GPM object. This object is the root object in the GPMC object model. You need the GPM object to access other GPMC interfaces, which then provide access to further capabilities. For example, you need the GPM object to access the IGPMDomain interface, which lets you create a reference to an Active Directory (AD) domain. After you have the reference to the AD domain, you can call IGPMDomain's GetGPO method to access the IGPMGPO interface and create a reference to a particular GPO that you want to manage. From here, the IGPMGPO interface contains methods and properties for managing that GPO. You can learn more about the GPMC object model in the Help file called gpmc.chm, which is in the Scripts folder. You can also learn about the object model in the Microsoft Developer Network's (MSDN's) Group Policy Management Console Reference at https://msdn.microsoft.com/library/en-us/gpmc/gpmc/group_policy_management_console_reference.asp.

Another interface that you're likely to run across is IGPMConstants, which is a special interface in GPMC scripting. This interface provides a set of properties that represent GPO-related constants that you'll often need in your GPMC scripts. For example, suppose you need to set the permissions to control who can edit a GPO. You could use a complex set of file-system and AD ACLs to represent the Edit permission, but that approach would take a lot of code work. So, Microsoft provided the IGPMConstants interface to do the work for you. You can simply call the IGPMConstants interface's PermGPOEdit property to represent the appropriate permission. To access the IGPMConstants interface, you use the GPM object's GetConstants method. After using the GetConstants method to obtain a reference to the GPMConstants object, you can then use any of the GPMConstants properties within your scripts.

Listing 1 shows the code that you use to create the GPM and GPMConstants objects. Let's look at two sample scripts—GetGPOPerms.vbs and RSoPLogging.vbs—to see how you build on this code. Admittedly, these scripts aren't the most basic. I didn't want to duplicate the GPMC scripts that Microsoft provides.

Listing 1 Code That Creates the GPM and GPMConstants Objects

BEGIN COMMENT
' Code that creates the GPM object.
END COMMENT
Set GPMC = CreateObject("GPMgmt.GPM")
BEGIN COMMENT
' Code that creates the GPMConstants object.
END COMMENT
Set Constants = GPMC.GetConstants()