ICT-Hotlist Topic

Back to the ICT-Hotlist...

Use PowerShell to show a GPO name for an ID or all GPO ID's

By Johan van Soest.

Published : 2017-03-03.

Last updated : 2017-05-02.

Did you notice that there is still a PowerShell or CMD script running during the user logon process but do not know the exact policy that triggers the script? Here is a PowerShell script to find the GPO name to update the policy.
For example: you need to remove a script in the logon policy. But where is it used? How to proceed.

The following command searches the logon server nlaaldc1 for PowerShell scripts used in GPO's:

 c:\dir \\nlaaldc1\sysvol\vanSoest.local\Policies\*.ps1 /s
 
 Directory of \\nlaaldc1\sysvol\vanSoest.local\Policies\{002316D1-0145-4175-A989-D1236059FBC5}\User\Scripts\Logon

09/28/2016  08:34 AM                98 Create-Value.ps1
               1 File(s)             98 bytes

This result shows the GPO ID 002316D1-0145-4175-A989-D1236059FBC5 instead of the friendly display name.

Copy the ID
Next run this PowerShell script:

 ###############################################################################################
 # This PowerShell script finds the GPO name for a GPO ID as listed in the sysvol folders
 #
 # (C)Copyrights 2016 - 2023 vanSoest.it by J.P.G. van Soest
 ###############################################################################################

cls
Write-Host "This PowerShell script displays the GPO name of a certain ID or all GPO's in a sortable grid."
#Load Active Directory Group Policy module
Import-Module GroupPolicy -ErrorAction Stop

$RequestID = Read-Host -Prompt "Enter or copy the GPO ID, and I'll find the name, or enter * for all GPO's"
try{
	#Get the GPO
	if($RequestID -ne "*"){
		Get-Gpo -Guid $RequestID 
	}
	else{
		Get-Gpo -all | Select-Object ID, DisplayName | Out-GridView
	}
}
catch{
	Write-Host "An error has occurred" $_.Exception.Message $_.Exception.ItemName
}

This will produce the following output after you paste the ID in the PowerShell question:

This PowerShell script displays the GPO name of a certain ID or all GPO's in a sortable grid.
Enter or copy the GPO ID, and I'll find the name, or enter * for all GPO's: 002316D1-0145-4175-A989-D1236059FBC5


DisplayName      : NLAAL W7 Desktop
DomainName       : vanSoest.local
Owner            : vanSoest\Domain Admins
Id               : 002316d1-0145-4175-a989-d1236059fbc5
GpoStatus        : AllSettingsEnabled
Description      : 
CreationTime     : 08-Jan-17 09:38:51
ModificationTime : 05-Feb-17 13:22:51
UserVersion      : AD Version: 1, SysVol Version: 1
ComputerVersion  : AD Version: 60, SysVol Version: 60
WmiFilter        : Windows 7

There is your friendly DisplayName "NLAAL W7 Desktop" that can easily be found in the Group Policy Management console, to change it.
This topic is based on the article: Report on Group Policy Objects that have Logon Scripts. That article shows a script that collects even more data.

You may vote your opinion about this article:

Scripts and programming examples disclaimer

Unless stated otherwise, the script sources and programming examples provided are copyrighted freeware. You may modify them, as long as a reference to the original code and hyperlink to the source page is included in the modified code and documentation. However, it is not allowed to publish (copies of) scripts and programming examples on your own site, blog, vlog, or distribute them on paper or any other medium, without prior written consent.
Many of the techniques used in these scripts, including but not limited to modifying the registry or system files and settings, impose a risk of rendering the Operating System inoperable and loss of data. Make sure you have verified full backups and the associated restore software available before running any script or programming example. Use these scripts and programming examples entirely at your own risk. All liability claims against the author in relation to material or non-material losses caused by the use, misuse or non-use of the information provided, or the use of incorrect or incomplete information, are excluded. All content is subject to change and provided without obligation.