GPO Admin Template Policy Registry Value

This topic contains 2 replies, has 2 voices, and was last updated by Profile photo of Michael Delaney Michael Delaney 3 weeks, 4 days ago.

Viewing 3 posts - 1 through 3 (of 3 total)
  • Author
    Posts
  • #50121
    Profile photo of Michael Delaney
    Michael Delaney
    Participant

    Morning All,

    I`ve been tasked with writing a PowerShell script that generates a report of all of our GPO`s.

    I am wondering if there is a way using the GroupPolicy module to retrieve the location in the registry that an administrative template is modifying.

    For example,

    I have the policy Computer Configuration/Microsoft Office 2013 (Machine)/Updates Enable Automatic Updates set to disabled. Is it possible to get the full path under HKLM that this policy changes?

    I currently use a mix of Win7, Win8.1, and Win10 in my environment. PowerShell 4.0 and above in my environment as well.

    #50278
    Profile photo of Matt Bloomfield
    Matt Bloomfield
    Participant

    You can use Get-GPRegistry value but you have to specify the key. I knocked up this script which uses recursion to walk through a group policy object and expanding the key path until it finds a policy setting:

    function Get-GPORegistryKeys {
    
    param (
        [string]$GPOName,
        [string]$key
    )
    
        $keyCollection = Get-GPRegistryValue -Name $GPOName -Key $key | Select -ExpandProperty FullKeyPath
        
        foreach ($subkey in $keyCollection) {
            
            $keyInfo = Get-GPRegistryValue -Name $GPOName -Key $subKey
    
            if (($keyInfo.gettype() | Select -expandproperty Name) -eq 'PolicyRegistrySetting') {
    
                Write-Output "$($keyInfo.fullkeypath)\$($keyInfo.valuename)"
            
            } #end if 
    
            else {
    
                Get-GPORegistryKeys -GPOName $GPOName -key $subkey
            
            } #end else 
    
        } #end foreach $subkey
    
    } #end Get-GPORegistryKeys function
    
    Get-GPORegistryKeys -GPOName TestSales -Key HKLM\Software
    

    Output:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun
    HKEY_LOCAL_MACHINE\Software\policies\microsoft\office\15.0\common\officeupdate\enableautomaticupdates
    
    #53090
    Profile photo of Michael Delaney
    Michael Delaney
    Participant

    Thanks for the reply!

    I've tried the snippet, but the code is failing to produce any results on my machine.

    I've set some breakpoints in the code to see what's going on. It gets down to where some registry values are, but then gets stuck in a recursive loop.

    When stepping through the code, $keyinfo.gettype() returns System.Array for the basetype, object[] for the name.

Viewing 3 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.