Group Policy Cmdlets in Windows PowerShell

The Windows PowerShell command-line and scripting language can be used to automate many Group Policy tasks, including configuring registry-based policy settings and various Group Policy Management Console (GPMC) tasks. To help you perform these tasks, the Group Policy module for Windows PowerShell provides the cmdlets covered in this section. You can use these Group Policy cmdlets to perform the following tasks for domain-based Group Policy objects (GPOs): 1. Maintain GPOs: GPO creation, removal, backup, reporting, and import. 2. Associate GPOs with Active Directory, Directory Services (AD DS) containers: Group Policy link creation, update, and removal. 3. Set inheritance and permissions on AD DS organizational units (OUs) and domains. 4. Configure registry-based policy settings and Group Policy Preferences Registry settings.

Group Policy Cmdlet Prerequisites

To use the Windows PowerShell cmdlets for Group Policy, you must be running one of the following: Windows Server 2008 R2 on a domain controller --or-Windows Server 2008 R2 on a member server that has the GPMC installed --or-Windows 7 with Remote Server Administration Tools (RSAT) installed. (RSAT includes the GPMC and the Group Policy cmdlets)

Getting Started with the Group Policy Cmdlets

You must use the import-module grouppolicy command to import the Group Policy module before you use the Group Policy cmdlets. You can also modify your Windows PowerShell profile to import the Group Policy module every time you start a session. For more information, see about_Modules. You can use the get-command module grouppolicy to get a list of all Group Policy commands. You can get help for all Group Policy commands at once by using the get-command module grouppolicy | get-help command. Note: For more information about the Group Policy cmdlets, you can use the get-help<cmdlet-name> and get-help<cmdlet_name>-detailed commands to display basic and detailed help, respectively. Because the information displayed by the get-help cmdlet can span many screens, the help alias is provided to display the first page of information. You can then press the spacebar to view subsequent pages of information. This has the same effect as using the more commandfor example, get-help <your parameters> | more.

Group Policy Cmdlets Name Backup-GPO Copy-GPO Get-GPInheritance Get-GPO Get-GPOReport Get-GPPermissions Get-GPPrefRegistryValue Get-GPRegistryValue Get-GPResultantSetOfPolicy Get-GPStarterGPO Import-GPO New-GPLink New-GPO New-GPStarterGPO Remove-GPLink Remove-GPO Remove-GPPrefRegistryValue Remove-GPRegistryValue Rename-GPO Restore-GPO Set-GPInheritance Set-GPLink Set-GPPermissions Set-GPPrefRegistryValue Description Backs up one GPO or all the GPOs in a domain. Copies a GPO. Retrieves Group Policy inheritance information for a specified domain or OU. Gets one GPO or all the GPOs in a domain. Generates a report in either XML or HTML format for a specified GPO or for all GPOs in a domain. Gets the permission level for one or more security principals on a specified GPO. Retrieves one or more registry preference items under either Computer Configuration or User Configuration in a GPO. Retrieves one or more registry-based policy settings under either Computer Configuration or User Configuration in a GPO. Outputs the Resultant Set of Policy (RSoP) information to a file, for a user, a computer, or both. Gets one Starter GPO or all Starter GPOs in a domain. Imports the Group Policy settings from a backed-up GPO into a specified GPO. Links a GPO to a site, domain, or OU. Creates a new GPO. Creates a new Starter GPO. Removes a GPO link from a site, domain, or OU. Deletes a GPO. Removes one or more registry preference items from either Computer Configuration or User Configuration in a GPO. Removes one or more registry-based policy settings from either Computer Configuration or User Configuration in a GPO. Assigns a new display name to a GPO. Restores one GPO or all GPOs in a domain from one or more GPO backup files. Blocks or unblocks inheritance for a specified domain or OU. Sets the properties of the specified GPO link. Grants a level of permissions to a security principal for one GPO or for all the GPOs in a domain. Configures a registry preference item under either Computer Configuration or User Configuration in a GPO.

Set-GPRegistryValue

Configures one or more registry-based policy settings under either Computer Configuration or User Configuration in a GPO.