SERVER-014 · Script

Audit Group Policy

Reviews every Group Policy object for links, empty or half-disabled policies, filters and missing read access.

What it does

For each Group Policy object (GPO) in the domain, reports: where it is linked, and whether each link is enabled or enforced

• Unlinked: not linked anywhere, so it does nothing
• Empty: has no settings in either half

Disabled half a half (computer or user) is turned off but still holds settings, or is on with none

• All disabled: both halves are turned off

No read access neither Authenticated Users nor Domain Computers can read it, so computers may skip it

• WMI filter: the filter name, if one is attached

last changed date, and the version numbers of each half Read-only; changes nothing.

Requirements

Windows PowerShell 5.1 and the GroupPolicy module (Group Policy Management tools, RSAT). Any domain account can usually read GPOs.

How to run it

• Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
• Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
• Script type: PowerShell 5.1, 64-bit
• User interaction: none; the script never prompts
• Timeout: 30 minutes for large directories or many servers

Settings

Exit codes

• 0 = No issues (or AlertOn is Never)
• 1 = One or more GPOs have issues
• 2 = Script error (see log)

Testing steps

1. Run it on one test OU, test account or test server and check the output and log.
2. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
3. Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log