Skip to main content

How to Enable / Disable a basic GPO Setting with PowerShell

PowerShell allows you to make changes to your Group Policy objects.  This is a good way to create an automatic response to changes in your network environment.   The script below will show you how to configure a basic GPO setting.
A Basic GPO setting has three possible states:
  • Not Configured
  • Enabled
  • Disabled

We are going to use the GPO setting of Automatically Publish new Printers in Active Directory as our test subject.  A GPO called GPO-Test was created to house this setting. 
Using the Group Policy Settings Reference from Microsoft, I located the registry key in question:
HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Auto Publishing
The value name is Auto Publishing.
When set to Enabled, the REG-DWORD is set to 0x00000001 (1)
When set to Disabled, the value is set to 0x00000000 (0)
When set to Not Configured, The value of Printers is not present in the registry.

This script is designed to show you how to achieve all three settings.  You can complete this task in just one command line.  Just take the code from one of the functions and plug in your values.  This code includes error checking in two areas that testing determined that an error could happen.

<#
===========================================================
Script Name: BasicGPOSettings.ps1
Author: Jason A. Yoder, MCT
Website: WWW.MCTExpert.com
Blogsite: WWW.MCTExpert.Blogspot.com
-----------------------------------------------------------
Script Purpose:
Demonstrate how to use PowerShell to change a basic
GPO Settings

-----------------------------------------------------------
Requirements:
- Must be ran on a Domain Controller or Windows 7 Client
  with RSAT installed.

- User must have the necessary permissions to modify
  the GPO.

-----------------------------------------------------------
Revision History:
Currently Version 1.0

-----------------------------------------------------------
Known Issues:
None.

-----------------------------------------------------------
#>
Set-StrictMode -version 2.0
# Variables:
# $GPOName: Holds the name of the Group Policy to be
# modified.
$GPOName = "GPO-Test"
# $ListKey : The registry key to be modified
$ListKey = "HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard"
# $ListValueName : TheValueName to be changed.
$ListValueName = "Auto Publishing"
# $Decision : Will record the users choice on when
# value to set in the GPO.
$Decision = 0
# $QuestionString : String to display the valid choices
# to the user.
$QuestionString = "Please select from the following: 'r
1) - Set the policy to `"Enable`" `r
2) - Set the policy to `"Disabled`" `r
3) - Set the policy to `"Not Configured`" `r
4) - Retrieve the current policy information`" `r
5) - Exit the script without making changes"

# =========================================================

# =========================================================
# Functions:

# Enable_Setting will set the GPO value to "Enabled"
Function Enable_Setting
    {
        Set-GPRegistryValue -Name $GPOName -Key $ListKey `
       -ValueName $ListValueName -Type DWORD -Value 1 
       Write-Host "The GPO value has been enabled."
    }
# Disable_Setting will set the GPO value to "Disabled"
Function Disable_Setting
    {
       
Set-GPRegistryValue -Name $GPOName -Key $ListKey `
       -ValueName $ListValueName -Type DWORD -Value 0  
        Write-Host "The GPO value has been disabled."
    }
   
# Get_Current_Value will display the current value for the GPO setting.
# Error handling is set should this value be set to "Not Configured."
# In a "Not Configured" state, the GPO value is not present and would
# otherwise error out.
Function Get_Current_Value
    {
        Try {Get-GPRegistryValue -Name $GPOName -Key `
        $ListKey -ErrorAction Stop}
        Catch { Write-Host "This GPO value is `"Not Configured`"."
                Write-Host "No data to return."}
    }
# NC_Setting will set the GPO value to "Disabled"
# Error handling is set should this value be set to "Not Configured."
# In a "Not Configured" state, the GPO value is not present and would
# otherwise error out.
Function NC_Setting
    {
        Write-Host "Setting the value to `"Not Configured`"."
        Try { Remove-GPRegistryValue -Name $GPOName -Key `
        $ListKey -ValueName $ListValueName -ErrorAction Stop}
        Catch { Write-Host "This GPO value is already set to `"Not Configured`"."}
    }
   
# == End of Functions : ===================================
# =========================================================
# Main Code:

# Announce the start of the script.
Clear-Host
Write-Host "=== Starting Script: BasicGPOSettings.ps1 ===" -foregroundcolor green

# Import the cmdlet needed for this operation from the
# GroupPolicy module
Import-Module GroupPolicy -cmdlet Set-GPRegistryValue, Remove-GPRegistryValue, Get-GPRegistryValue
# Display the users choices and record their decision in
# The variable $Decision.
$Decision = Read-Host ($QuestionString)
# Use the switch statement against $Decision to determine
# which function to execute.  Set the Switch statement to
# end on the first match. Set a DEFAULT value should the
# user select option 5 or provide an invalid input.
Switch ($Decision)
    {
        1 {Enable_Setting; Break}
        2 {Disable_Setting; Break}
        3 {NC_Setting; Break}
        4 {Get_Current_Value; Break}
        Default {"No Changes Made"; Break}
     }
    
# Announce the end of the script.
Write-Host "=== Ending Script: BasicGPOSettings.ps1 ===" -foregroundcolor green
# == End of Main Code =====================================

Comments

Popular posts from this blog

Adding a Comment to a GPO with PowerShell

As I'm writing this article, I'm also writing a customization for a PowerShell course I'm teaching next week in Phoenix.  This customization deals with Group Policy and PowerShell.  For those of you who attend my classes may already know this, but I sit their and try to ask the questions to myself that others may ask as I present the material.  I finished up my customization a few hours ago and then I realized that I did not add in how to put a comment on a GPO.  This is a feature that many Group Policy Administrators may not be aware of. This past summer I attended a presentation at TechEd on Group Policy.  One organization in the crowd had over 5,000 Group Policies.  In an environment like that, the comment section can be priceless.  I always like to write in the comment section why I created the policy so I know its purpose next week after I've completed 50 other tasks and can't remember what I did 5 minutes ago. In the Group Policy module for PowerShell V3, th

Return duplicate values from a collection with PowerShell

If you have a collection of objects and you want to remove any duplicate items, it is fairly simple. # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   # Remove the duplicate values. $Set1 | Select-Object -Unique 1 2 3 4 5 6 7 What if you want only the duplicate values and nothing else? # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   #Create a second collection with duplicate values removed. $Set2 = $Set1 | Select-Object -Unique   # Return only the duplicate values. ( Compare-Object -ReferenceObject $Set2 -DifferenceObject $Set1 ) . InputObject | Select-Object – Unique 1 2 This works with objects as well as numbers.  The first command creates a collection with 2 duplicates of both 1 and 2.   The second command creates another collection with the duplicates filtered out.  The Compare-Object cmdlet will first find items that are diffe

How to list all the AD LDS instances on a server

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.