Automate GPO settings

PowerShell Help
21

Hi Dave,

I came across your pol file editor and I am trying to make local GOP changes on a Windows 2012 R2 VPS. I have limited Powershell (and Windows) programming experience so my code is based on the examples in this post. Am not getting any errors but am not seeing any changes either. Any ideas? My environment is 2012 R2, with PowerShell 4.0, PowerShell 2.0 Engine, .NET 3.5 (including 2.0/3.0), .NET 4.5 features installed. Any help with this is greatly appreciated.

$pathToCSFile = 'C:\Users\Administrator\Documents\PolFileEditor.cs'

Add-Type -Path $pathToCSFile -ErrorVariable Stop

$polFile = New-Object TJX.PolFileEditor.PolFile
try
{
    $polFile.LoadFile("$env:systemroot\system32\GroupPolicy\Machine\registry.pol")
}
catch
{
    throw
}

$polFile.SetDWORDValue('SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU', 'ScheduledInstallDay', 1)

try
{
    $polFile.SaveFile()
}
catch
{
    throw
}

$gptContents = Get-Content $env:systemroot\system32\GroupPolicy\gpt.ini

$gptContents |
ForEach-Object {
    [regex]::Replace($_, '(?<=Version\s*=\s*)\d+', { [int]$args[0].Value + 1 })
} |
Set-Content $env:systemroot\system32\GroupPolicy\gpt.ini
22

Other than the -ErrorVariable Stop bit (should be -ErrorAction), I don’t see anything obviously wrong with your code. You can search for a free utility called polviewer.exe to double check that the registry setting you specified was added to the registry.pol file.

23

Thanks Dave. After taking another look I realized I needed to update the local group policy for the changes to apply. The following lines did the trick.

Invoke-Command {
gpupdate /force
}

Thanks again for all your help

24

your c# code is working properly for the current user(administrator) who runs the code… but i want to restrict a specific user, how an administrator can restrict some group policy setting to a specific user … please help me out…

25

Depends on what version of Windows you’re running. Starting in Server 2008, you can create user-specific local GPOs. If I remember correctly, those go into C:\Windows\System32\GroupPolicyUsers(SID)\registry.pol. Those files can be managed with the same PolFileEditor class as in the example code earlier in this thread; you just pass a different path to LoadFile().

For server 2003, you’re out of luck. There were only a single User and Computer registry.pol file, and no way to apply settings to specific users or groups without using Active Directory GPOs.

26

Just thinking aloud here, but maybe (aka big disclaimer…) one way you could do this synthetically would be to define the ‘run’ setting for the user policy, configuring it to perform a reg.exe operation on the appropriate key. Also set an ACL on the branch of the registry affected to block/allow as required via in the local policy. Set the permissions to be linked to either local or domain based membership, or just local or domain users. Because the runonce action itself (not the application of the policy setting) should be running in the user context it means the key can be evaluated based on the user logging in and processed accordingly. Would mean you’re a bit goosed if that registry branch contains other keys that you need to be set by policy…

27

First of all thanks for the script it works as a charm,

Now to my question:

I’m not a powershell master nor a C# master, but i would like to delete a reg entry in the local policy file.
I found the “DeleteValue” in the PolFilEditor.cs but i have tried to use in the powershell script provided here but it does not work.
Do you have any suggestion how-to accomplish this?

Brgds,
Joel

28

hii Dave Wyatt, actually i am using windows 7 professional and it is a stand alone system , in this system there are many users. and if a administrator wants to restrict a specific user how to do that… Initially C:\Windows\System32\GroupPolicyUsers\ contains no file or folder… how to do that… please help me out…

29

hii Dave Wyatt, actually i am using windows 7 enterprise edition and it is a stand alone system , in this system there are many users. and if a administrator wants to restrict a specific user how to do that… Initially C:\Windows\System32\GroupPolicyUsers\ contains no file or folder… how to do that… please help me out…

30

Hi,

My issue:
[i] First of all thanks for the script it works as a charm,

Now to my question:

I’m not a powershell master nor a C# master, but i would like to delete a reg entry in the local policy file.
I found the “DeleteValue” in the PolFilEditor.cs but i have tried to use in the powershell script provided here but it does not work.
Do you have any suggestion how-to accomplish this?[/i]

Is solved, the problem was how i interpreted the code in Pol file.

Thanks,
joel

31

Hi, Sorry I don’t know much about scripting. My question here is how do I add string value using polfileeditor.cs to registry.pol file?

Example: $polFile.SetStringValue(‘Software\Policies\Microsoft\Windows\EventLog\Security’, ‘Retention’, ‘1’)

It is not working. Please help. Thanks

32

Hello Dave,
I want to automate a task in Windows server 2012 R2 where we need to enable “Allow DNS Suffix Appending to Unqualified MultiLable Name Query” and “Click on Allow NetBT queries for fully qualified domain name”. This can be found in the path Gpedit.msc – >Computer Configuration ->Administrative Templates ->DNS Client. I tried to change registry keys but it is not reflecting on GUI. As reference to earlier post, I tried with below code, but is not working for me.

Update the registry.pol file

$pathToCSFile = ‘.\PolFileEditor.cs’
Add-Type -Path $pathToCSFile -ErrorAction Stop

$polFile = New-Object TJX.PolFileEditor.PolFile

if (Test-Path “$env:systemroot\system32\GroupPolicy\Machine\registry.pol”)
{
try
{
$polFile.LoadFile(“$env:systemroot\system32\GroupPolicy\Machine\registry.pol”)
}
catch
{
throw
}
}

$polFile.SetDWORDValue(‘SOFTWARE\Policies\Microsoft\Windows NT\DNSClient’, ‘AppendToMultiLabelName’, 1)

try
{
$polFile.SaveFile()
}
catch
{
throw
}

Update the gpt.ini file

$gptContents = Get-Content $env:systemroot\system32\GroupPolicy\gpt.ini

$gptContents |
ForEach-Object {
[regex]::Replace($_, '(?< =Version\s*=\s*)\d+', { [int]$args[0].Value + 1 })
} |
Set-Content $env:systemroot\system32\GroupPolicy\gpt.ini

33

Hi Shanu - I have exactly the same requirement but I cant find the .cs file here in the forum… Can you guide/

Thank you

34

I use the PolicyFileEditor module, blogged about here: http://brandonpadgett.com/powershell/Local-gpo-powershell/