Export (0) Print
Expand All

Scripting Group Policy-related Tasks

Updated: April 7, 2003

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

The GPMC user interface is based on a set of COM interfaces that accomplish most of the operations performed by GPMC. These interfaces are available to Windows scripting technologies like JScript and VBScript as well as programming languages such as Visual Basic and VC++. For example, the following capabilities are scriptable using these interfaces:

  • Creating/deleting/renaming GPOs.

  • Linking/unlinking GPOs and WMI filters.

  • Delegation:

    • Security on GPOs and WMI filters.

    • Group Policy-related security on sites, domains, OUs.

    • Creation rights for GPOs and WMI filters.

  • Generating reports of GPO settings.

  • Generating reports of RSOP data.

  • Backup/Restore of GPOs.

  • Import/Export, Copy/Paste of GPOs.

  • Search for GPOs, WMI filters, SOMs, and backups.

These interfaces are discussed in detail in the GPMC software development kit (SDK) located in the %programfiles%\gpmc\scripts\gpmc.chm help file on systems where GPMC has been installed. The contents of the GPMC SDK are also available in the Platform SDK.

GPMC comes with a number of sample scripts (written mostly in VBScript but some JScript) that form a toolkit of scripts that administrators can use to directly administer a Group Policy environment or as examples to build more elaborate management tools. The scripts are installed in the %programfiles%\gpmc\scripts directory. Table 5 shows a list of scripts that are provided to do the associated types of Group Policy administrative tasks:

Table 5


Administrative task Script name Description

Back up a GPO


Backs up all GPOs in a domain to the specified backup directory.

Back up all GPOs in a domain


Given a GPO name or a GUID, backs up the GPO to a specified backup directory.

Create a GPO with default options


Creates a GPO with the specified name, in the current domain, using the default options.

Create a migration table


Populates the entries of a migration table with security principals and UNC paths that are referenced in a GPO or backup.

Copy a GPO


Creates a new GPO and copies the settings from the source GPO into the new destination GPO, given a source GPO name or GUID and a new destination GPO name.

Create a policy environment using an XML representation


Reads an XML file that specifies a policy environment; for example, OUs, GPOs, links, and security groups. The script can either create the environment in a domain by creating the objects, or delete the environment by deleting objects specified in the XML file.

Create an XML representation of a policy environment


Reads an existing policy environment and creates an XML file representing that environment. The XML file captures information about OUs, GPOs, and GPO links, and security on GPOs. You can use this script in conjunction with the CreateEnvironmentFromXML.wsf script to create a replica of domain for staging purposes.

Delete a GPO


Deletes the specified GPO when given a GPO name or GUID. By default the script deletes links to that GPO within the same domain.

Grant Permissions for all GPOs in a Domain


Grants a user or group the specified level of permission for all GPOs in the specified domain.

Generate a report for a GPO


Creates an HTML and XML report for a given GPO at a given location in the file system.

Generate a report for all GPOs in the domain


Creates HTML and XML reports for all GPOs in the domain, at a given location in the file system.

Import settings into a GPO


Imports the settings from the specified backup to the existing destination GPO in the domain

Import multiple GPOs into a domain


Creates a new GPO and imports settings into that GPO for each backed-up GPO stored at a specific file system location.

Restore a GPO


Restores a backed-up GPO.

Restore all GPOs


Restores all GPOs that are stored at a given file system location

Grant permissions for GPOs linked to a domain, OU, or site


Grants a user or group the specified permission type for all GPOs that are linked to a specified domain, OU, or site. You can specify Read, Apply, Edit, FullEdit, or None for the permission type.

Set GPO permissions


Sets the permission level for a security principal on a given GPO. You can specify Read, Apply, Edit, FullEdit, or None for the permission type.

Set permissions to create GPOs


Grants or removes the ability to create GPOs in a domain for a given security principal.

Set policy-related permissions on a given site, domain, or OU


Sets policy-related permissions on a given scope of management (SOM). A SOM is any site, domain, or OU.

List all GPOs in a domain


Prints all GPOs in the specified domain.

List disabled GPOs


Prints all GPOs in the specified domain that are disabled or partially disabled.

List GPO information


Prints the information for a specific GPO, including creation time, modification time, owner, status, version number, links, security groups that filter the GPO, and security groups that have full control, edit, read, or custom permissions.

List scope of management information


Prints all information for a specific Scope of Management (SOM), including GPO links and policy related permissions on the SOM. A SOM is any site, domain, or OU.

List GPO by policy extension


Prints all GPOs in the specified domain for which a specific policy extension is configured; for example, find all GPOs that contain the Software Installation or Folder Redirection policy settings.

List GPOs by security group


Prints all GPOs that for which a given security principal has the specified permission on that GPO. You can specify Read, Apply, Edit, or Fulledit for the permission type.

List GPOs with duplicate names


Prints all GPOs in the specified domain that have duplicate names.

List GPOs without Apply permission


Prints all GPOs in the specified domain that do not apply to anyone because Apply permission is not set on the GPO.

List GPOs Orphaned in SYSVOL


Finds and prints all GPOs in SYSVOL with no corresponding component in Active Directory.

List domains and OUs with external GPO links


Prints all domains and OUs in the specified domain that link to a GPO in a different domain.

List unlinked GPOs in a domain


Prints all GPOs in the specified domain that have no links. Links outside the domain, including site links, are not checked.

Print the scope of management policy tree


Prints all SOMs in the specified domain with the list of GPOs that are linked to the domain and each OU.

List GPO backups in a given file system location


Prints information about all backed up GPOs at the file system location specified by the user.

All of the scripts are intended for command line operation. The user can execute a script using the following command (using the CreateGPO script as an example) from a command shell:

    Cscript CreateGPO.wsf

Alternatively, you can set Cscript to be the default scripting engine by using this command:

    cscript //H:cscript

The user will need to run the scripts from the %programfiles%\gpmc\scripts directory or by specifying the path to the scripts directory. To see usage details for any script, use the “/?” command line option.

Community Additions

© 2016 Microsoft