Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Wednesday, May 4, 2016 4:01 PM
Hi, is there a way to edit a gpo via powershell ?
I mean, not rename but rather going into editing mode, and edit the actual stuff.
Like going to Administrative Templates , disable and enable things.
Is that possible with powershell?
Best,
Alexandru
All replies (11)
Wednesday, May 4, 2016 4:49 PM ✅Answered
There are no editing CmdLets. A template is not a GPO but is used to generate a GPO.
Well, you can edit any registry-based settings which definitely is more than nothing.
Evgenij Smirnov
msg services ag, Berlin -> http://www.msg-services.de
my personal blog (mostly German) -> http://it-pro-berlin.de
Windows Server User Group, Berlin -> http://www.winsvr-berlin.de
Mark Minasi Technical Forum, reloaded -> http://newforum.minasi.com
How can you do that? YOU need to know the exact policy and adjust the XML accordingly then register the GPO.
Yes. You can edit preferences,
If you are a master of GP then the XML is the easiest method. Search for articles on editing GPO files. Here is one tested edit module.
\(ツ)_/
Wednesday, May 4, 2016 4:03 PM
Here you go:
https://technet.microsoft.com/de-de/library/ee461027.aspx
Evgenij Smirnov
msg services ag, Berlin -> http://www.msg-services.de
my personal blog (mostly German) -> http://it-pro-berlin.de
Windows Server User Group, Berlin -> http://www.winsvr-berlin.de
Mark Minasi Technical Forum, reloaded -> http://newforum.minasi.com
Wednesday, May 4, 2016 4:37 PM
There are no editing CmdLets. A template is not a GPO but is used to generate a GPO.
\(ツ)_/
Wednesday, May 4, 2016 4:44 PM
There are no editing CmdLets. A template is not a GPO but is used to generate a GPO.
Well, you can edit any registry-based settings which definitely is more than nothing.
Evgenij Smirnov
msg services ag, Berlin -> http://www.msg-services.de
my personal blog (mostly German) -> http://it-pro-berlin.de
Windows Server User Group, Berlin -> http://www.winsvr-berlin.de
Mark Minasi Technical Forum, reloaded -> http://newforum.minasi.com
Wednesday, May 4, 2016 4:56 PM
Here's the example from TechNet:
Set-GPRegistryValue -Name "TestGPO" -key "HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop" -ValueName ScreenSaveTimeOut -Type DWORD -value 900
This is NOT a preference but a regular GP. Of course, you need to know the exact registry path and value, but those are listed in the Excel files, on MSDN and elsewhere.
Evgenij Smirnov
msg services ag, Berlin -> http://www.msg-services.de
my personal blog (mostly German) -> http://it-pro-berlin.de
Windows Server User Group, Berlin -> http://www.winsvr-berlin.de
Mark Minasi Technical Forum, reloaded -> http://newforum.minasi.com
Wednesday, May 4, 2016 5:02 PM
Yes - that works for some things. Again. Yu have to understand the GPO. Some GPOs are more complex bit for simple value based registry GPOs this works.
\(ツ)_/
Wednesday, May 4, 2016 6:02 PM
Thank you for your replies guys.
What my boss wants is a powershell script that runs every 60 minutes. This is the easy part.
The idea is that this scripts first deletes the gpo, and after that it creates it, every hour.
The gpo consists in deploying fonts for users from a network share, and register them of course. :)
So if someone adds new fonts in the share, the gpo will be created adding these new fonts to it.
http://blog.the-it-blog.co.uk/2014/05/29/deploy-font-files-via-a-gp-group-policy/
Wednesday, May 4, 2016 6:18 PM
Might really take a look at DSC for that...
Evgenij Smirnov
msg services ag, Berlin -> http://www.msg-services.de
my personal blog (mostly German) -> http://it-pro-berlin.de
Windows Server User Group, Berlin -> http://www.winsvr-berlin.de
Mark Minasi Technical Forum, reloaded -> http://newforum.minasi.com
Wednesday, May 4, 2016 6:50 PM
GPO would give you headaches if you try to use it like a database. It is unlikely that the GPO subsystem would survive such frequent modification.
Use DSC as recommended. Just tell DSC to always apply new fonts. DSC can scan as frequently as needed but you would want a pull server.
It may be easier to define a scheduled task in a GPO. The task would copy any new fonts once an hour or more.
\(ツ)_/
Thursday, May 5, 2016 12:23 PM
Okay, this looks really interesting, but I'm a junior :) started 1 month ago.
I need to research, is DSC = Desired State Configuration ?
Best,
Alexandru
Tuesday, January 8, 2019 3:37 PM
thanks for the info. Ill go there