No announcement yet.

GPO Audit

  • Filter
  • Time
  • Show
Clear All
new posts

  • GPO Audit

    We are using GPMC for group policy,(Enviroment = Windows 2003, Forest & Domain level is 2000)

    We have around 250 policies in that I am not sure whether all are in suse for some of them are just created and left as it is.
    1) i want to find out which policies is not applied or not in use (may some one created it just for testing and left as it is)
    2) How to find out which policies are applied where in AD(OU, Site etc)

    I am not familiar for GPMC tool is there a way in it, or do we have any script for complete the above task.

    Thanks in advacce

    Muneer Khan

  • #2
    Re: GPO Audit

    Look in the folder where you installed GPMC in (by default:C:\Program Files\GPMC).
    There in a subfolder 'Scripts' you find several tools that you can run from a batch.
    (Group Policy Management Console Scripting)

    @echo off
    Set "GPMCScript=%programfiles%\GPMC\Scripts\FindUnlinkedGPOs.wsf"
    Set "FQDN=MyDomain.local"
    Set "OutputFile=c:\GPOsStatus.txt"
    Set "line=------------"
    Set "line=%line%%line%%line%%line%%line%%line%%line%%line%%line%%line%"
    >>"%OutputFile%" (echo.&echo.%line%+)
    >>"%OutputFile%" (echo.&echo.%date% - %time%)
    Start ""/B /W Cscript.exe //NoLogo "%GPMCScript%" /domain:%FQDN% /v>>"%OutputFile%"2>&1
    Other tools from that folder you might find usefull:
    - ListAllGPOs.wsf (list all GPOs and links)
    - FindDisabledGPOs.wsf (To find disabled GPOs in the AD domain)
    - FindUnlinkedGPOs.wsf And FindOrphanedGPOsInSYSVOL.wsf (To find unlinked GPOs in the AD domain)
    - GetReportsForAllGPOs.wsf (To find GPOs with NO settings defined in both the computer part and user part)

    Last edited by Rems; 24th March 2008, 00:04. Reason: Added the switch /v (verbose)

    This posting is provided "AS IS" with no warranties, and confers no rights.


    ** Remember to give credit where credit's due **
    and leave Reputation Points for meaningful posts