Scripting Group Policy tasks using GPMC

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Scripting Group Policy tasks

The Group Policy Management Console (GPMC) provides a comprehensive set of COM interfaces for scripting many Group Policy-related operations. The interfaces are documented in the Group Policy Management Console SDK, which is located at %programfiles%\gpmc\scripts\gpmc.chm on any computer where you installed GPMC. (The Group Policy Management Console SDK is only available in English.)

When you install GPMC, a set of sample scripts illustrating the use of these interfaces are installed to the %programfiles%\gpmc\scripts directory.

The sample scripts address real-world administrative problems and scenarios. You can perform various tasks such as finding all Group Policy objects (GPOs) in a domain that have duplicate names or generating a list of all GPOs in a domain whose settings are disabled or partially disabled.

Note

• Scripted control of individual settings inside a GPO is not provided.

The scripts include examples written in VBScript and JScript. They all have the .wsf extension and are executed through Windows Script Host (WSH), which is included with Windows Server 2003 and other recent versions of Windows. All of the scripts should be executed from the command line. Executing a script with the /? switch displays the usage for that script.

The sample scripts echo output to the command window and must be executed using cscript.exe. If cscript.exe is not your default scripting host, you will need to explicitly specify cscript.exe on the command line. For example: "d:\program files\gpmc\scripts>cscript ListAllGPOs.wsf".

Note

• You can run "cscript //H:cscript" from a command line to make cscript the default scripting host.

You can modify and distribute the sample scripts in accordance with the terms of the End User License Agreement.

Many of the sample scripts rely on a library of common helper functions contained in the file Lib_CommonGPMCFunctions.js. If you copy these scripts to another location, you must also copy this library file to that location for the script samples to work.

Scripting samples for Group Policy administrative tasks

The following table shows the administrative tasks you can perform with sample scripts included with Group Policy Management.

Administrative task	Script name	Description
Back up all GPOs in a domain	BackupAllGPOs.wsf	Backs up all GPOs in a domain to the specified folder.
Back up a GPO	BackupGPO.wsf	Given a GPO name or a globally unique identifier (GUID), backs up the GPO to the specified folder.
Copy a GPO	CopyGPO.wsf	Creates a new GPO and copies the settings from the source GPO into the new destination GPO, given a source GPO name or GUID and a new destination GPO name.
Create a policy environment using an XML representation	CreateEnvironmentFromXML.wsf	Reads an XML file that specifies a policy environment; for example, organizational units, GPOs, links, and security groups. The script can either create the environment in a domain by creating the objects, or delete the environment by deleting objects specified in the XML file.
Create a GPO with default options	CreateGPO.wsf	Creates a GPO with the specified name, in the current domain, using the default options.
Create a migration table	CreateMigrationTable.wsf	Creates migration tables that can be edited and used to map paths and security principals to new values when importing and copying GPOs across domains.
Create an XML representation of a policy environment	CreateXMLFromEnvironment.wsf	Reads an existing policy environment and creates an XML file representing that environment. The XML file captures information about organizational units, GPOs, and GPO links, and security on GPOs. You can use this script in conjunction with the CreateEnvironmentFromXML.wsf script to create a replica of a domain for staging purposes.
Delete a GPO	DeleteGPO.wsf	Deletes the specified GPO when given a GPO name or GUID. By default the script deletes links to that GPO within the same domain.
Grant Permissions for all GPOs in a Domain	GrantPermissionOnAllGPOs.wsf	Grants a user or group the specified level of permission for all GPOs in the specified domain.
Import settings into a GPO	ImportGPO.wsf	Imports the settings from the specified backup to an existing destination GPO in the specified domain.
Import multiple GPOs into a domain	ImportAllGPOs.wsf	Creates a new GPO and imports settings into that GPO for each backed-up GPO stored at a specific file system location.
Restore a GPO	RestoreGPO.wsf	Restores a backed-up GPO.
Restore all GPOs	RestoreAllGPOs.wsf	Restores all GPOs that are stored at a given file system location
Grant permissions for GPOs linked to a domain, organizational unit, or site	SetGPOPermissionsBySOM.wsf	Grants a user or group the specified permission type for all GPOs that are linked to a specified domain, organizational unit, or site. You can specify Read, Apply, Edit, FullEdit, or None for the permission type.
Set GPO permissions	SetGPOPermissions.wsf	Sets the permission level for a security principal on a given GPO. You can specify Read, Apply, Edit, FullEdit, or None for the permission type.
Set permissions to create GPOs	SetGPOCreationPermissions.wsf	Grants or removes the ability to create GPOs in a domain for a given security principal.
Set policy-related permissions on a given site, domain, or organizational unit	SetSOMPermissions.wsf	Sets policy-related permissions on a given site, domain, or organizational unit.
List disabled GPOs	FindDisabledGPOs.wsf	Prints all GPOs in the specified domain that are disabled or partially disabled.
List GPO information	DumpGPOInfo.wsf	Prints the information for a specific GPO, including creation time, modification time, owner, status, version number, security groups that filter the GPO, security groups that have full control, edit, read, or custom permissions, and links.
List scope of management information	DumpSOMInfo.wsf	Prints information for a specific site, domain, or organizational unit, including GPO links and policy-related permissions.
List GPO by policy extension	FindGPOsByPolicyExtension.wsf	Prints all GPOs in the specified domain for which a specific policy extension is configured; for example, find all GPOs that contain the Software Installation or Folder Redirection policy settings.
List GPOs by security group	FindGPOsBySecurityGroup.wsf	Prints all GPOs on which a given security principal has the specified permission or effective permission. You can specify Read, Apply, Edit, or Fulledit for the permission type.
List GPOs with duplicate names	FindDuplicateNamedGPOs.wsf	Prints all GPOs in the specified domain that have duplicate names.
List GPOs without Apply permission	FindGPOsWithNoSecurityFiltering.wsf	Prints all GPOs in the specified domain that do not apply to anyone because Apply permission is not set on the GPO.
Listing GPOs Orphaned in SYSVOL	FindOrphanedGPOsInSYSVOL.wsf	Finds and prints all GPOs in SYSVOL with no corresponding component in Active Directory.
List domains, organizational units, and sites with external GPO links	FindSOMsWithExternalGPOLinks.wsf	Prints all domains, organizational units, and sites in the specified domain that link to a GPO in a different domain.
List unlinked GPOs in a domain	FindUnlinkedGPOs.wsf	Prints all GPOs in the specified domain that have no links. Links outside the domain, including site links, are not checked.
Get reports for all GPOs	GetReportsForAllGPOs.wsf	Takes a domain name, and gets reports for all GPOs in that domain.
Get reports for GPO	GetReportsForGPO.wsf	Generates XML and HTML reports for a given GPO.
List all GPOs in a domain	ListAllGPOs.wsf	Prints all GPOs in the specified domain.
Print the scope of management policy tree	ListSOMPolicyTree.wsf	Prints a list of all organizational units in the specified domain with the list of GPOs that are linked to the domain and each organizational unit.
List GPO backups in a given file system location	QueryBackupLocation.wsf	Prints information about all backed up GPOs at the file system location specified by the user.

See Also

Concepts

Group Policy Object Editor Extensions
Scripts overview for GPMC