Techibee.com

While working on GPOs related stuff, initially I struggled to find a way to know list of GPOs available in my machine. After a bit of research I found that list will be available at registry location “HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonGPExtensions”. I am satisfied and started looking at this location whenever I want to know CSE settings. But a bit later, I found this procedure also little bit difficult and finally relied on my favorite to get this information for me.  Below are the examples,

To list all CSEs installed in my machine alone with their GUID, use below one liner.

PS C:> Get-ItemProperty “HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogonGPExtensions*” | ft “(default)”, PSChildName

And the output of above command will be something like this…

To list the properties of a given CSE(say drive mappings), use the below one liner.

PS C:> Get-ItemProperty “HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogonGPExtensions*” | where {“$_.(default)” -like “*drive*”}

Similarly, to list the Internet Explorer Branding CSE related settings, use the below one.

PS C:> Get-ItemProperty “HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogonGPExtensions*” | where {“$_.(default)” -like “*Internet Explorer Branding*”}

Similarly, you can play with remaining options if you have some PS knowledge. Let me know if can not make out any particular thing.

Happy Learning..,
Sitaram Pamarthi

“I have a GPO GUID and want to know to which GPO this belongs to?”. If that is your question, you can happily use the below method.  For this you need to have “support tools” of Windows 2003.  You can get it from Microsoft Web Site as well. Alternatively, you can copy search.vbs from any machine where support tools package is installed.

cscript /nologo search.vbs “LDAP://dc=mydomain,dc=com” /C:”&(objectClass=groupPolicyContainer)(name={31B2F340-016D-11D2-945F-00C04FB984F9})” /P:displayName /S:SubTree

tags:how to find GPO name, GPO GUID to name resolution

• Windows 7
• Windows Vista

• Applications (User-based)
  
• Drive Mapping (User-based)
  
• Environment Variables (User-based and computer-based)
  
• Files (User-based and computer-based)
  
• Folders (User-based and computer-based)
  
• Ini Files (User-based and computer-based)
  
• Registry (User-based and computer-based)
  
• Shortcuts (User-based and computer-based)
  
• Network Shares (Computer-Based)
  
• DataSources (User-based and computer-based)
  
• Devices (User-based and computer-based)
  
• Folder Options (User-based and computer-based)
  
• Internet Settings (User-Based)
  
• Local Users and Groups (User-based and computer-based)
  
• Network Options (User-based and computer-based)
  
• Power Options (User-based and computer-based)
  
• Printers (User-based and computer-based)
  
• Regional Options (User-based)
  
• Scheduled Tasks (User-based and computer-based)
  
• Start Menu (User-Based)
  
• Services (Computer-Based)

• You can restrict the desktops local administrators group membership. If any one adds their account to local admins, that will be taken off during the next GPO processing due to GPP setting.
  
• You can execute scripts, commands in user context at scheduled times.
  
• Control power options on laptops/desktops
  
• Easily deploy files to desktops based on user and computer
  
• Push short cuts to user/desktops
  
• And GPPs can definitely replace some of the settings which are being handled by your computer/user login scripts now. Using GPPs for these settings considerably less time than using scripts.