0

[SOLVED]: When creating GPO programmatically, the gPCMachineExtensionNames property in the LDAP entry for the policy isn't set. We put some code in the script to export the key to a txt file and then reimported it at the client sites and everything went fine after that.

I created a script to create a GPO that we use during onboarding of new clients. Unfortunately, the way GPO is handled, some of the settings are saved in XML files. The XML file I'm battling with right now is for service settings. Unfortunately, this file isn't portable because of the UID in the NTService line. I believe this is equal to a UID for the user account that this service is set to run under (NetworkService, in this case).

I just want to be able to scoot the script and a directory with the XML files over to the client DC and execute the script (which will change out that UID so the XML files are valid). The script will create the GPO, insert the registry settings into the GPO, find the GPO GUID, copy the XML files from the directory to the GPO directory based on the GPO GUID it found.

\DomainController\SYSVOL\domain.local\Policies{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}\Machine\Preferences\Services

So far all of that works except the finding and replacing the UID bit. Unfortunately, that bit prevents it from applying the service settings to the computers at the client site.

<?xml version="1.0" encoding="utf-8"?>
<NTServices clsid="{2CFB484A-4E96-4b5d-A0B6-093D2F91E6AE}"><NTService clsid="{AB6F0B67-341F-4e51-92F9-005FBFBA1A43}" name="WinRM" image="2" changed="2018-06-13 20:23:16" uid="{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}"><Properties startupType="AUTOMATIC" serviceName="WinRM" serviceAction="START" timeout="30"/>`</NTService>
</NTServices>

I've been at it for a couple days now so any help would be greatly appreciated.

0

Unfortunately, this file isn't portable because of the UID in the NTService line. I believe this is equal to a UID for the user account that this service is set to run under (NetworkService, in this case).

According to the XML spec for group policy preferences, the uid value is not related to the user you're configuring the service to run as. From the link, it is:

A unique GUID generated when the preferences element is created and used to uniquely identify the preference item for tracing and reporting.

As a demonstration, try creating a new GPO via GPMC that contains two different service pref entries, both running as NETWORK SERVICE. Then examine the generated XML. The uid values will be completely different. Record the current values for reference later.

Modify the GPO and switch the accounts to LOCAL SERVICE. Then notice that both values have changed and are still different. Now modify the GPO again and set them back to NETWORK SERVICE. The values will have changed again and are not the same as the original values you recorded.

Unfortunately, I don't think the uid value is the root of your problem unless you've accidentally duplicated the values anywhere. That might screw things up if they're meant to be unique.

As a side note, I could've sworn there were more elegant ways to programmatically create a GPO that might be less problematic...possibly via libraries that come with GPMC.

| improve this answer | |
  • Hey, thanks for the reply! You are probably right. I'm wondering, then, where the hold up is for porting the XML files over to a different domain. If you move the XML file into the proper directories and go into the GUI to edit the settings, they all look correct but it'll crash out MMC if you try to change anything and the settings won't apply downstream. – Nathanial Meek Jun 14 '18 at 22:55
  • The idea behind this script is to make it super simple for a low level engineer to dump the registry keys into machine/user CSV files and have a script dump the XML into a folder structure and then have a script turn around and push that out at a new client. I'm not sure why but GPManage sees the settings when you check it, even at a client site. Computers at the client site will pull the registry settings but don't want anything to do with the files copied into the folder structure. Unfortunately, that nukes both of the two ideal ways to configure service settings through GPO that I know of. – Nathanial Meek Jun 15 '18 at 0:57
  • Would appear that it was a missing LDAP entry that informed the client devices that there were additional files to apply. "gPCMachineExtensionNames" has to be edited to filled in manually in order to programmatically generate GPO. I'm going to work the code to export this key to a txt file and reimport it on the client side tomorrow. I'll report back with information on whether I get it fixed or not. – Nathanial Meek Jun 15 '18 at 1:25
  • Sounds like you're on the right track. Congrats! – Ryan Bolger Jun 15 '18 at 2:46
  • That seems to have been the problem! Thanks for the assist, without it, I'd have spent far too much time spinning my wheels elsewhere. – Nathanial Meek Jun 15 '18 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.