Freigeben über

Create ConfigMgr Configuration Items from Group Policy Object

  • Artikel

I have been asked by customers if it is possible to use ConfigMgr to monitor compliance of Group Policy settings.  The short answer has always been yes but it is not easy.  If you had to manually identify all the registry keys associated with a GPO and create the individual CI rules this process could takes hours if not days for larger policies.  This script simplifies the process and queries for the values and creates the CIs in a matter of seconds.  I have seen similar scripts however many of the others still require user to create a .POL file for the script to ingest then import a .CAB file into ConfigMgr.  This script fully automates the process.

What Does it Do?

This script uses both the Configuration Manager and Active Directory PowerShell modules to query for registry keys associated with Group Policies then create the Configuration Items for each of the registry values.  I have updated the script to include a few options on how this gets done.

First, the script will either query for a single group policy or utilize a Resultant Set of Policy to determine applicable policies for a specified system.  To enable the Resultant Set of Policy (RSOP) option include the 'ResultantSetOfPolicy' parameter and specify the system to run RSOP against using the 'ComputerName' parameter.  Leveraging the Active Directory PowerShell module and the Get-GPResultantSetOfPolicy command the script will run an RSOP on a specified system and export the results to a temporary file.  The file is then searched to determine what group policies are applied to the system and what the link order is for those policies.  This will be used to determine what order the group policy data is queried to simulate their link order.  If the 'ResultantSetOfPolicy' option is not used this step is skipped and the script will query only for the one group policy specified.

To get a list of registry keys associated with the group policies the Get-GPRegistryValue command is used to query for the specified group policies.  The full key path, key name, value and data type are all stored in an array.  When the 'ResultantSetOfPolicy' option is used the group policies will be queried starting with the policy that would be applied last.  As each additional policy is queried the script will check to see if that registry key has already been stored with another value.  If the registry key is already present, the additional occurrence of that key will be skipped since the policy that is last applied would over write the lower policies.  If the 'ResultantSetOfPolicy' option is not used the script will only query for the one policy specified.

Once the script has successfully queried for all the associated registry keys and values it utilized the Configuration Manager PowerShell module to create the Configuration Item definition files in xml format.  This will include a setting and rule for each of the registry keys of supported data type (binary values are not supported by DCM).  You can specify the severity of non-compliant settings as well as remediation of non-compliant items using command line parameters.

The final step is to import the Configuration Item definition file into Configuration Manager.  By default, this is done automatically, creating a CI with settings and rules for all associated registry values.  If you do not wish to have this automatically created you can use the 'ExportOnly' parameter which will save the data to a .cab file which can later be manually imported into Configuration Manager.

In my tests, this script can query for and create a CI with over 200 registry values in under 20 seconds.

How to Use the Script

This script must be executed from a system that has access to both the GroupPolicy and ConfigurationManager PowerShell modules.  The GroupPolicy module is installed with the Remote Admin Tools and the ConfigurationManager module is installed with the ConfigMgr Admin Console.  Additionally, if the 'ResultantSetOfPolicy' option is used the user must have remote admin access to that system.  Extract the .ZIP file and execute the PowerShell script via a PS console.

Download Here >> Convert-GPOtoCI_1.2.6

Parameters:

  • GroupPolicy [optional] - This is enabled by default and will make the script query only for one specified group policy.
  • GpoTarget [required unless ResultantSetOfPolicy option is used] - Name of group policy object
  • ResultantSetOfPolicy [optional] - Utilizes a resultant set of policy to determine the set of applied GPOs.  Cannot be used in conjunction with the GroupPolicy option.
  • ComputerName [required when ResultantSetOfPolicy is used] - Name of system to run RSOP on.
  • DomainTarget [required] - Fully qualified domain name
  • SiteCode [required] - ConfigMgr site code
  • Remediate [optional] - Enable configuration item to remediate non-compliant settings
  • Severity [optional] - Sets the severity of non-compliant items.  (None, Informational, Warning or Critical)
  • ExportOnly [optional] - Exports the Configuration Item to a CAB file to be manually imported
  • Log [optional] - Writes all discovered registry keys and their related GPO name to a file.

Example 1:

.\Convert-GPOtoCI.ps1 -GpoTarget "Windows 10 Settings" -DomainTarget contoso.com -SiteCode T01

Example 2:

.\Convert-GPOtoCI.ps1 -GpoTarget "Windows 10 Settings" -DomainTarget contoso.com -SiteCode T01 -Remediate

Example 3:

.\Convert-GPOtoCI.ps1 -GroupPolicy -GpoTarget "Windows 10 Settings" -DomainTarget contoso.com -SiteCode T01 -Severity Warning

Example 4:

.\Convert-GPOtoCI.ps1 -ResultantSetOfPolicy -ComputerName lab-srv-test01 -DomainTarget contoso.com -SiteCode T01

Example 5:

.\Convert-GPOtoCI.ps1 -GpoTarget "Windows 10 Settings" -DomainTarget contoso.com -SiteCode T01 -ExportOnly

Tested On:

Configuration Manager vNext 1706

 

Download Here >> Convert-GPOtoCI_1.2.6

 

 

Change Log

v 1.1.1 (7/12/2017)

  • Added -ExportOnly switch that will export the Configuration Item data to a .CAB file instead of automatically creating the CIs.  This file can be used to import the CI into ConfigMgr.

v 1.2.1 (7/17/2017)

  • Added -ResultantSetOfPolicy parameter to enable to script to run RSOP against a system to determine the applied group policies then query for all registry keys associated with the applicable policies and settings.

v 1.2.3 (9/18/2017)

  • Added the -Log switch that will log all discovered registry keys and their related Group Policy object to a file named gpo_registry_discovery_mmddyyyy.log in the scripts root directory.

v 1.2.4 (9/18/2017)

  • Fixed bug where registry values were always being logged to file even when the -Log switch was not set.

v 1.2.6 (11/6/2017)

  • Bug fixes.
  • Allow for creation of User Policy based CIs.

Comments

  • Anonymous
    July 27, 2017
    Hello Sam, this is really useful script and I would like to thank you for publishing it. I have one question, would it be possible to get CI from server Local Policy too? (there are companies that dont use GPOs much, and importing CIs from local policies to SCCM would be helpful way to start getting it under control there)
    • Anonymous
      July 27, 2017
      Thank you for your feedback. Currently the script does not handle Local Policy but I can work on that in future versions. When I query for the Resultant Set of Policy on a system the data is stored in XML format so I will have to write a function to parse the data out of XML.
  • Anonymous
    August 01, 2017
    HiI ran and completed the script, ran without failure, however when I can to add it to SCCM it failed to import with a content schema validation failed message, any reason why?
    • Anonymous
      August 02, 2017
      The comment has been removed
  • Anonymous
    September 14, 2017
    Hi Sam, great script it has saved me loads of painful work. I do have a question for you however, I have created a GPO based on the settings specified in the CIS Benchmarks, I have then used your script to convert the GPO to configuration baselines which have then perfectly been imported in to SCCM. When I check the baseline against a machine there are settings listed as not being compliant which I haven't even configured in the GPO itself, is there any way I can output the GPO to see where it is pulling these settings from? e.g. there are 177 settings and my machine is out of compliance with 16 settings which I haven't even selected in the GPO.Thanks for any help you can give.
    • Anonymous
      September 15, 2017
      Currently the script does not output these details however it should not be a difficult change for me to make. I will work on updating the script to include an option to output the list of registry keys and values and the Group Policy Object they came from.
    • Anonymous
      September 18, 2017
      James,I just uploaded a new version (1.2.3) that has the ability to write the registry keys and GPO names to a tab delimited text file. Just add the -Log switch and it will create a file in the script root directory.
      • Anonymous
        November 10, 2017
        Awesome thank you Sam, I've been able to track them doing using the log and clean things up. Thanks once again!
  • Anonymous
    November 10, 2017
    The comment has been removed
    • Anonymous
      November 12, 2017
      The Set-Location error means that the PowerShell console cannot connect to the ConfigMgr site. So either the PowerShell module did not load properly or something else is preventing the connection. Please double check that you have access to the Site and that the firewall is not blocking the connection.
  • Anonymous
    January 03, 2018
    Hello Sam,thanks for the post. Correct me if im wrong Get-GPRegistryValue reads off the registry.pol file for the registry settings? if that is the case how does it handle keys with del option? I set fAllowUnsolictited to disable which seem to automatically set fAllowUnsolicitedFullControl(child option) registry value to delete in the pol file. Basically i have **del.fAllowUnsolicitedFullControl but this value is coming back as non compliance, does your script isolate this values?
    • Anonymous
      January 04, 2018
      I have not tested checking compliance for registry deletes. I will have to test this in my lab and see how the values are returned and see if I can make an exception for the delete option. If you need help identifying any values that may be effected try using the -Log switch to log off of the discovered registry values to a test file.
  • Anonymous
    February 14, 2018
    Hi Sam, Amazing script, saved me a ton of time when creating the needed CI's from Group Policy. One issue I am facing which you might have seen is that when remediating the regkeys it seems to create them as QWORDS and not DWORDS. This might be a ConfigMgr bug but the option to create as Dword is enabled in the CI settings but still it creates a QWORD. Come across this before in your testing?
    • Anonymous
      February 23, 2018
      I have never seen this in my testing. When I have some time I will try it in my lab and see if I can reproduce the issue. Other than that one issue and I happy to hear that this script has helped save you some time.