Scripting Group Policy tasks using GPMC

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Scripting Group Policy tasks

The Group Policy Management Console (GPMC) provides a comprehensive set of COM interfaces for scripting many Group Policy-related operations. The interfaces are documented in the Group Policy Management Console SDK, which is located at %programfiles%\gpmc\scripts\gpmc.chm on any computer where you installed GPMC. (The Group Policy Management Console SDK is only available in English.)

When you install GPMC, a set of sample scripts illustrating the use of these interfaces are installed to the %programfiles%\gpmc\scripts directory.

The sample scripts address real-world administrative problems and scenarios. You can perform various tasks such as finding all Group Policy objects (GPOs) in a domain that have duplicate names or generating a list of all GPOs in a domain whose settings are disabled or partially disabled.

Note

  • Scripted control of individual settings inside a GPO is not provided.

The scripts include examples written in VBScript and JScript. They all have the .wsf extension and are executed through Windows Script Host (WSH), which is included with Windows Server 2003 and other recent versions of Windows. All of the scripts should be executed from the command line. Executing a script with the /? switch displays the usage for that script.

The sample scripts echo output to the command window and must be executed using cscript.exe. If cscript.exe is not your default scripting host, you will need to explicitly specify cscript.exe on the command line. For example: "d:\program files\gpmc\scripts>cscript ListAllGPOs.wsf".

Note

  • You can run "cscript //H:cscript" from a command line to make cscript the default scripting host.

You can modify and distribute the sample scripts in accordance with the terms of the End User License Agreement.

Many of the sample scripts rely on a library of common helper functions contained in the file Lib_CommonGPMCFunctions.js. If you copy these scripts to another location, you must also copy this library file to that location for the script samples to work.

Scripting samples for Group Policy administrative tasks

The following table shows the administrative tasks you can perform with sample scripts included with Group Policy Management.

Administrative task Script name Description

Back up all GPOs in a domain

BackupAllGPOs.wsf

Backs up all GPOs in a domain to the specified folder.

Back up a GPO

BackupGPO.wsf

Given a GPO name or a globally unique identifier (GUID), backs up the GPO to the specified folder.

Copy a GPO

CopyGPO.wsf

Creates a new GPO and copies the settings from the source GPO into the new destination GPO, given a source GPO name or GUID and a new destination GPO name.

Create a policy environment using an XML representation

CreateEnvironmentFromXML.wsf

Reads an XML file that specifies a policy environment; for example, organizational units, GPOs, links, and security groups. The script can either create the environment in a domain by creating the objects, or delete the environment by deleting objects specified in the XML file.

Create a GPO with default options

CreateGPO.wsf

Creates a GPO with the specified name, in the current domain, using the default options.

Create a migration table

CreateMigrationTable.wsf

Creates migration tables that can be edited and used to map paths and security principals to new values when importing and copying GPOs across domains.

Create an XML representation of a policy environment

CreateXMLFromEnvironment.wsf

Reads an existing policy environment and creates an XML file representing that environment. The XML file captures information about organizational units, GPOs, and GPO links, and security on GPOs. You can use this script in conjunction with the CreateEnvironmentFromXML.wsf script to create a replica of a domain for staging purposes.

Delete a GPO

DeleteGPO.wsf

Deletes the specified GPO when given a GPO name or GUID. By default the script deletes links to that GPO within the same domain.

Grant Permissions for all GPOs in a Domain

GrantPermissionOnAllGPOs.wsf

Grants a user or group the specified level of permission for all GPOs in the specified domain.

Import settings into a GPO

ImportGPO.wsf

Imports the settings from the specified backup to an existing destination GPO in the specified domain.

Import multiple GPOs into a domain

ImportAllGPOs.wsf

Creates a new GPO and imports settings into that GPO for each backed-up GPO stored at a specific file system location.

Restore a GPO

RestoreGPO.wsf

Restores a backed-up GPO.

Restore all GPOs

RestoreAllGPOs.wsf

Restores all GPOs that are stored at a given file system location

Grant permissions for GPOs linked to a domain, organizational unit, or site

SetGPOPermissionsBySOM.wsf

Grants a user or group the specified permission type for all GPOs that are linked to a specified domain, organizational unit, or site. You can specify Read, Apply, Edit, FullEdit, or None for the permission type.

Set GPO permissions

SetGPOPermissions.wsf

Sets the permission level for a security principal on a given GPO. You can specify Read, Apply, Edit, FullEdit, or None for the permission type.

Set permissions to create GPOs

SetGPOCreationPermissions.wsf

Grants or removes the ability to create GPOs in a domain for a given security principal.

Set policy-related permissions on a given site, domain, or organizational unit

SetSOMPermissions.wsf

Sets policy-related permissions on a given site, domain, or organizational unit.

List disabled GPOs

FindDisabledGPOs.wsf

Prints all GPOs in the specified domain that are disabled or partially disabled.

List GPO information

DumpGPOInfo.wsf

Prints the information for a specific GPO, including creation time, modification time, owner, status, version number, security groups that filter the GPO, security groups that have full control, edit, read, or custom permissions, and links.

List scope of management information

DumpSOMInfo.wsf

Prints information for a specific site, domain, or organizational unit, including GPO links and policy-related permissions.

List GPO by policy extension

FindGPOsByPolicyExtension.wsf

Prints all GPOs in the specified domain for which a specific policy extension is configured; for example, find all GPOs that contain the Software Installation or Folder Redirection policy settings.

List GPOs by security group

FindGPOsBySecurityGroup.wsf

Prints all GPOs on which a given security principal has the specified permission or effective permission. You can specify Read, Apply, Edit, or Fulledit for the permission type.

List GPOs with duplicate names

FindDuplicateNamedGPOs.wsf

Prints all GPOs in the specified domain that have duplicate names.

List GPOs without Apply permission

FindGPOsWithNoSecurityFiltering.wsf

Prints all GPOs in the specified domain that do not apply to anyone because Apply permission is not set on the GPO.

Listing GPOs Orphaned in SYSVOL

FindOrphanedGPOsInSYSVOL.wsf

Finds and prints all GPOs in SYSVOL with no corresponding component in Active Directory.

List domains, organizational units, and sites with external GPO links

FindSOMsWithExternalGPOLinks.wsf

Prints all domains, organizational units, and sites in the specified domain that link to a GPO in a different domain.

List unlinked GPOs in a domain

FindUnlinkedGPOs.wsf

Prints all GPOs in the specified domain that have no links. Links outside the domain, including site links, are not checked.

Get reports for all GPOs

GetReportsForAllGPOs.wsf

Takes a domain name, and gets reports for all GPOs in that domain.

Get reports for GPO

GetReportsForGPO.wsf

Generates XML and HTML reports for a given GPO.

List all GPOs in a domain

ListAllGPOs.wsf

Prints all GPOs in the specified domain.

Print the scope of management policy tree

ListSOMPolicyTree.wsf

Prints a list of all organizational units in the specified domain with the list of GPOs that are linked to the domain and each organizational unit.

List GPO backups in a given file system location

QueryBackupLocation.wsf

Prints information about all backed up GPOs at the file system location specified by the user.

See Also

Concepts

Group Policy Object Editor Extensions
Scripts overview for GPMC