searching GPOs

[msi_school]

Hi

 

We have lots of GPOs linked to various OUs and I want to find out where password complexity is being set.

 

Is there a way of searching all the GPOs to see which ones are changing a particular setting or do I have to go through each GPO individually?

 

Thanks

 

Mike

[SavedZelda]

Hi Mike,

 

Normally password requirements are set in the default domain policy - well at least that’s where it should be.

 

I’m not aware of any way to search for keywords in GPOs sadly!

[computer_expert]

you could run gpresult on a client machine to generate a HTML report and see which GPO wins:

 

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult

[Guest Guest]

Do you different password policies for different types of users? If so these aren't set in group policy their set in the Active Directory Administrative Center

[msi_school]

Thanks, it was a fine grained policy in ADAC, I had found the settings in the default domain policy but they did not match and after reading your post I checked the ADAC and found the setting.

 

However, a method of searching all the GPOs to find where one setting is being configured would be useful when trouble shooting a GPO issue rather than running GPResult and then checking the policies to see what has been set, as it can get a bit confusing especially if like me you have just taken over a new network and the GPO labels are not always totally clear to a new admin, I know I have not always understood my own naming convention six moths after setting up the GPO.

 

Mike

[HPlum78]

I wrote a powershell script to do just this, I will dig it out and post it shortly.

[HPlum78]

Oh and you can use the get-ADFineGrainedPasswordPolicy -Filter * and the if you want to change any settings you can use Set-ADFineGrainedPasswordPolicy

[HPlum78]

param (
[Parameter(Mandatory=$true)] 
[boolean] $IsComputerConfiguration,

[Parameter(Mandatory=$true)] 
[string] $Extension, 

[Parameter(Mandatory=$true)] 
[string] $Where,

[Parameter(Mandatory=$true)]
[string] $Is,

[Parameter(Mandatory=$false)]
[string] $Return,

[Parameter(Mandatory=$false)] 
[string] $DomainName =[system.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
)


function print
{  
param
(
$displayName,
$value
)

$host.UI.WriteLine();

$stringToPrint = "The Gpo '" + $displayName + "' has a " +$Extension + " setting where '" + $Where + "' is equal to '" +$Is + "'";

if ($Return -ne $null)
{
$stringToPrint += " and the value of its '" + $Return + "' property is: '" + $value + "'";
}

$host.UI.Write([ConsoleColor]::Magenta,[ConsoleColor]::Black, $stringToPrint);
$host.UI.WriteLine();
}

function processNodes
{
param
(
$nodes,
$foundWhere
)

$thePropertyWeWant = $Where;

# If we already found the $Where then we are looking for our $Return value now.
if ($foundWhere)
{
$thePropertyWeWant = $Return;
}

foreach($node in $nodes)
{
$valueWeFound = $null;

#Here we are checking siblings  
$lookingFor = Get-Member -InputObject $node -Name$thePropertyWeWant;  

if ($lookingFor -ne $null)
{
$valueWeFound = $node.($lookingFor.Name);
}
else #Here we are checking attributes.
{
if ($node.Attributes -ne $null)
{  
$lookingFor =$node.Attributes.GetNamedItem($thePropertyWeWant);

if( $lookingFor -ne $null)
{  
$valueWeFound = $lookingFor;
}
}
}  

if( $lookingFor -ne $null)
{  
#If we haven't found the $Where yet, then we may have found it now.  
if (! $foundWhere)
{  
# We have found the $Where if it has the value we want.
if ( [string]::Compare($valueWeFound, $Is, $true) -eq 0 )
{  
# Ok it has the value we want too. Now, are we looking for a specific
# sibling or child of this node or are we done here?
if ($Return -eq $null)
{
#we are done, there is no $Return to look for
print -displayName $Gpo.DisplayName -value $null;
return;  
}
else
{
# Now lets look for $Return in the siblings and then if no go, the children.  
processNodes -nodes $node -foundWhere $true;  
}
}

}  
else
{
#we are done. We already found the $Where, and now we have found the $Return.
print -displayName $Gpo.DisplayName -value$valueWeFound;
return;  
}
}  


if (! [string]::IsNullOrEmpty($node.InnerXml))
{  
processNodes -nodes $node.ChildNodes -foundWhere$foundWhere;
}  
}
}

#Import our module for the call to the Get-GPO cmdlet
Import-Module GroupPolicy;

$allGposInDomain = Get-GPO -All -Domain $DomainName;

$xmlnsGpSettings ="[url]http://www.microsoft.com/GroupPolicy/Settings[/url]";
$xmlnsSchemaInstance ="[url]http://www.w3.org/2001/XMLSchema-instance[/url]";
$xmlnsSchema = "[url=http://www.w3.org/2001/XMLSchema]XML Schema[/url]";

$QueryString = "gp:";

if($IsComputerConfiguration){ $QueryString +="Computer/gp:ExtensionData/gp:Extension"; }
else{ $QueryString +="User/gp:ExtensionData/gp:Extension"; }

foreach ($Gpo in $allGposInDomain)
{  
$xmlDoc = [xml] (Get-GPOReport -Guid $Gpo.Id -ReportType xml -Domain $Gpo.DomainName);  
$xmlNameSpaceMgr = New-ObjectSystem.Xml.XmlNamespaceManager($xmlDoc.NameTable);

$xmlNameSpaceMgr.AddNamespace("",$xmlnsGpSettings);
$xmlNameSpaceMgr.AddNamespace("gp",$xmlnsGpSettings);
$xmlNameSpaceMgr.AddNamespace("xsi",$xmlnsSchemaInstance);
$xmlNameSpaceMgr.AddNamespace("xsd",$xmlnsSchema);

$extensionNodes =$xmlDoc.DocumentElement.SelectNodes($QueryString,$XmlNameSpaceMgr);

foreach ($extensionNode in $extensionNodes)
{  
if([string]::Compare(($extensionNode.Attributes.Item(0)).Value,
"[url]http://www.microsoft.com/GroupPolicy/Settings/[/url]" +$Extension, $true) -eq 0)
{
# We have found the Extension we are looking for now recursively search
# for $Where (the property we are looking for a specific value of).

processNodes -nodes $extensionNode.ChildNodes -foundWhere $false;  
}
}  
}

[msi_school]

Thank you for this, I can see it getting some use over the next few months.

 

Mike