I would like to get in .csv (or any other readable format) all my AD users and the policies that they need to comply (the type of authentication each user needs, his event logging properties and even which encryption he is allowed to use in BitLocker).

Get-ADUser and CSVDE commands do not give me all the policies.

Basically I need sort of a merge between GPO per user...

The only "solution" I've found is the command GPResults for each user, but it only works if the users are logged on, which is not good enough.

Thanks, Nir


Group Policy:
The user's policy isn't solely dependant on the user object - it can be affected by wmi filters, foreign domain groups or Authentication Mechanism Assurance, meaning your group membership is changed according to the way you provided your credentials. In short - the only 100% accurate way is actually logging in and checking GP results.

You can try GP result "planning", meaning all of the extensions are asked "what would you have done if this user was logged in", but they have to support it (not to mention installed on your machine) and it's not easily as scriptable as GP result "logging" - there's no easy PowerShell command for it AFAIK, and it has to be done using WMI.

Other stuff:
Note that some of the things you specified aren't GP extensions at all. For instance, password policy is set at the DC level, even if it's fine grained.

What you should do: If I were you, I'd make a list of things that matter to me (you started doing it - bitlocker encryption, password policy, group policy), and treat each one differently (since they have to be treated differently). You'll end up with set of data about each policy, which you can consider merging (my guess is that you won't, since it doesn't bring any new insight).
The important part to script is the data collection (and not the summarization), since this is the part that requires tedious work and not creative thinking.

| improve this answer | |
  • While there is no quick fix powershell command, there is a module for group policy reporting now. So you're not limited to WMI. – Reaces Dec 16 '14 at 10:36
  • If you're referring to Get-GPOReport, it's nice but doens't to the same as GPResult - it prints the value of a GP and not "what would user X get if it logged in on server Y right now". Sorry if I was unclear about what you must do using WMI – Nitz Dec 16 '14 at 10:39

You can use powershell group policy commandlets.

You can get the users information using Get-ADUser.
You can then follow this up by using Get-GPInheritance on the users OU.
After this you can run Get-GPOReport on the resulting GPO's.
I haven't tried this before, but it should be possible with the new commandlets.

However this will be quite a bit of work and research to get going, and perhaps a bit much for the answers you're looking for.
Depending on how large your environment is, and how many group polices you have, it might be easier to follow Nitz's answer.

| improve this answer | |

I agree with Nitz, and if you got loopback processing for user setting that target computer, powershell or wmi can't guess that, a bit why the gpresult need the user logged on to list the actual policy.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.