查询 GPO 详情

我会为此使用一些小Powershell脚本，主要使用：

• 获取 ADOrganizationalUnit
• 获取 GPO
• 获取 GPOReport

从模块：

• 活动目录

• 组策略

  import-module ActiveDirectory
  import-module grouppolicy
  

像这样的东西：

我想知道为每个 OU 申请了多少 GPO。

$OUs = Get-ADOrganizationalUnit -filter * -properties DistinguishedName,LinkedGroupPolicyObjects
foreach($OU in $OUs) {
   write-host $OU.DistinguishedName : $OU.LinkedGroupPolicyObjects.count
}

没有参数和链接的 GPO

$GPOS = get-gpo -All | select-object DisplayName
foreach($GPO in $GPOS) {
   $myGPO = $GPO.DisplayName
   Get-GPOReport -Name "$myGPO" -ReportType Xml >tmp.xml
   [xml]$xmldata = get-content "tmp.xml"
   $computerLevel = $xmldata.GPO.Computer.ExtensionData | Measure-Object
   $userLevel = $xmldata.GPO.User.ExtensionData | Measure-Object
   $links = $xmldata.GPO.Linksto | Measure-Object

   $NbreLinks = $links.count
   $NbreComputerLevel = $computerLevel.Count
   $NbreUserLevel = $userLevel.count
   $totalParams = $NbreComputerLevel + $NbreUserLevel

   if (($totalParams -eq 0) -and ($NbreLinks -eq 0)) {
      write-host $myGPO
   }   
}

GPO 的参数少于 2 个，链接少于 2 个

与上面相同，但将if语句替换为：

if(($totalParams -lt 2) -and ($NbreLinks -lt 2)) {
   write-host $myGPO
}

• http://technet.microsoft.com/en-us/library/ee617236.aspx
• http://technet.microsoft.com/en-us/library/ee461027.aspx