PowerShellを使用してレポートを作成し、グループポリシーを分析する

 #      PS C:\>get-gpo -all | Sort CreationTime,Modificationtime | Select Displayname,*Time 

 #    ,    30  PS C:\>get-gpo -all | Where {$_.ModificationTime -ge (Get-Date).AddDays(-30)} 

 #       (Defaul Domain Policy) PS C:\>Get-GPOReport -name "Default Domain Policy" -ReportType HTML -Path "c:\work\ddp.htm" invoke-item "c:\work\ddp.htm" 

 #       PS C:\>Get-GPOReport -All -ReportType HTML -Path "c:\work\allgpo.htm" invoke-item "c:\work\allgpo.htm" 

 #        #   _   GPO PS C:\>Get-GPO -all | foreach { $f="{0}.htm" -f ($_.Displayname).Replace(" ","_") $htmfile=Join-Path -Path "C:\work" -ChildPath $f Get-GPOReport -Name $_.Displayname -ReportType HTML -Path $htmfile Get-Item $htmfile } 

 #requires -version 2.0 #find empty gpos in the domain Function Get-EmptyGPO { Param ( [Parameter(Position=0,ValueFromPipeline=$True, ValueFromPipelinebyPropertyName=$True)] [string]$DisplayName ) Begin { #import the GroupPolicy Module Import-Module GroupPolicy } Process { #create an XML report [xml]$report=Get-GPOReport -Name $displayname -ReportType XML #totally empty if ((-Not $report.gpo.user.extensiondata) -AND (-not $report.gpo.computer.extensiondata)) { #no extension data so write Get-GPO -Name $Displayname } } #process End {} } #function Function Test-EmptyGPO { Param ( [Parameter(Position=0,ValueFromPipeline=$True, ValueFromPipelinebyPropertyName=$True)] [string]$DisplayName ) Begin { #import the GroupPolicy Module Import-Module GroupPolicy } Process { #set default values $User=$False $Computer=$False #create an XML report [xml]$report=Get-GPOReport -Name $displayname -ReportType XML if ($report.gpo.user.extensiondata) { $User=$True } If ( $report.gpo.computer.extensiondata) { $Computer=$True } #write a custom object to the pipeline New-Object -TypeName PSObject -Property @{ Displayname=$report.gpo.name UserData=$User ComputerData=$Computer } } #Process End {} } #function #Get-GPO -All | Get-EmptyGPO #Get-GPO -All | Test-EmptyGPO 

 #requires -version 2.0 <# Find unlinked GPOs. This requires the Active Directory Module This version does not query for site links #> Import-Module ActiveDirectory,GroupPolicy #GUID regular expression pattern [Regex]$RegEx = "(([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12})" #create an array of distinguishednames $dn=@() $dn+=Get-ADDomain | select -ExpandProperty DistinguishedName $dn+=Get-ADOrganizationalUnit -filter * | select -ExpandProperty DistinguishedName $links=@() #get domain and OU links foreach ($container in $dn) { #pull the GUID and add it to the array of links get-adobject -identity $container -prop gplink | where {$_.gplink} | Select -expand gplink | foreach { #there might be multiple GPO links so split foreach ($item in ($_.Split("]["))) { $links+=$regex.match($item).Value } #foreach item } #foreach } #foreach container #$links <# get all gpos where the ID doesn't belong to the array write the GPO to the pipeline #> Get-GPO -All | Where {$links -notcontains $_.id} 

 #requires -version 2.0 #find GPOs with extra registry, ie non-ADM settings Function Test-GPOExtraRegistry { Param ( [Parameter(Position=0,ValueFromPipeline=$True, ValueFromPipelinebyPropertyName=$True)] [string]$DisplayName ) Begin { #import the GroupPolicy Module Import-Module GroupPolicy } Process { #create an XML report [xml]$report=Get-GPOReport -Name $displayname -ReportType XML #define the XML namespace $ns=@{q3="http://www.microsoft.com/GroupPolicy/Settings/Registry"} $nodes=Select-Xml -Xml $report -Namespace $ns -XPath "//q3:RegistrySetting" | select -expand Node | Where {$_.AdmSetting -eq 'false'} if ($nodes) { #extra settings were found so get the GPO and write it to the pipeline Get-GPO -Name $Displayname } } End {} } #function #Import-Module GroupPolicy #Get-GPO -all | Test-GPOExtraRegistry