How to use PowerShell to get linked GPO and GPO links report
When it comes to group policy objects (GPO) reporting, native Active Directory (AD) tools and consoles do not offer much help. Admins and technicians, therefore, use PowerShell to get GPO report for an OU, list all GPOs, get GPO links, get GPOs linked to OUs, find GPOs linked to domains or sites, get all GPOs and linked objects, list unused or disabled GPOs, identify frequently modified GPOs and more.
But PowerShell only adds to the complexity. Multiple cmdlets like get-gplink, get-gpo and get-gporeport have to be used in combination, along with various filters to use PowerShell to get GPO reports with the right information, in the required format. This article compares the procedure to generate the all linked GPOs objects report using PowerShell and ADManager Plus, a unified AD, Office 365 and Exchange Server management and reporting solution. ADManager Plus with its exclusive set of GPO reports makes reporting on GPOs a walk in the park.
Windows PowerShell
Steps to get all linked GPOs report using PowerShell.
- Ensure you have the necessary permissions to perform this action, and also to execute PowerShell scripts.
- Get the domain for which you wish to generate this report.
- Create the script using the Get-GPO and Get-GPOReport cmdlet, and execute it in the PowerShell window.
A sample PowerShell script to get all linked GPOs
Copied
Import-Module GroupPolicy
Get-GPO -All | Where-Object { $_ | Get-GPOReport -ReportType HTML | Select-String "<LinksTo>" }
Click to copy entire script
This script will list GPOs that are linked to an AD object, OUs, domain or site, in HTML format
ADManager Plus
To list all linked GPOs,
- Select All GPOs & Linked AD Objects report in GPO Reports section in the Reports tab.
- Select the domains from which you wish to list the GPOs, and click Generate.
- Click the Export as option, and select the desired format to export the report.
Screenshot
» Start 30-day Free Trial
Also, right from the report, you can enable or disable GPOs completely, or the user or computer configurations, as per your need.
Limitations of using PowerShell to get linked GPOs report
- You will not be able to list GPOs and GPO links using PowerShell if you do not have enough privileges in the AD domains from which you wish to generate this report. With ADManager Plus, admins or technician do not have to connect to the DC directly, eliminating the need to elevate users' or technicians' privileges in native AD.
- To export the report in a different format or to store the report in a different location, the PowerShell script has to be modified. ADManager Plus' Export as option allows you to export the report in CSV, PDF, HTML, or XLSX format with just mouse-clicks.
- If you wish to search the generated reports for any specific record or data, the PowerShell script doesn't offer any option. Nor does it offer any means to manage the GPOs from the report. ADManager Plus, on the other hand, offers a built-in search and also on-the-fly management actions in its reports to locate to enable or disable GPOs completely, or just their user or computer configuration settings right from the reports.
- You must know how to execute the scripts from the PowerShell window. As ADManager Plus enables you to perform all management and reporting operations with GUI-based actions, there is no need to depend on scripting. It also eliminates chances of error which could happen because of even the smallest of mistakes such as a misplaced hyphen or a comma, or a typo in the attribute or parameter names.
