1

I am trying to automate checking the audit settings on GPOs. In the GUI, to check one GPO, I'd open Group Policy Management Console, expand domains, the domain name, Group Policy Objects, select a GPO that I wanted to check, go to the delegation tab, choose advanced, advanced again on the setting window that opens, and finally select the Auditing tab. I want to add non-default settings here to all our GPOs and periodically check that those settings haven't been removed. I can query for GPOs with the "get-gpo" command, but that doesn't give me the information that I want. Any ideas how I could get the auditing information? I appreciate any help.

1 Answer 1

2

You'll want to make use of the Active Directory PSDrive and the Get-Acl cmdlet. Specifically,

Get-Gpo -All | ForEach-Object {$GPO = $_.DisplayName; Get-Acl -Path ("AD:\" + $_.Path) -Audit | Select-Object @{n="GPO";e={$GPO}},PSChildName,AuditToString,Audit}

That should get you started. Here is some more information about the AD: PSDrive.

1
  • Thank you. That gets me what I was looking for. Mar 30, 2020 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .