Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Tuesday, April 12, 2011

How to Enable / Disable a basic GPO Setting with PowerShell

PowerShell allows you to make changes to your Group Policy objects.  This is a good way to create an automatic response to changes in your network environment.   The script below will show you how to configure a basic GPO setting.
A Basic GPO setting has three possible states:
  • Not Configured
  • Enabled
  • Disabled

We are going to use the GPO setting of Automatically Publish new Printers in Active Directory as our test subject.  A GPO called GPO-Test was created to house this setting. 
Using the Group Policy Settings Reference from Microsoft, I located the registry key in question:
HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Auto Publishing
The value name is Auto Publishing.
When set to Enabled, the REG-DWORD is set to 0x00000001 (1)
When set to Disabled, the value is set to 0x00000000 (0)
When set to Not Configured, The value of Printers is not present in the registry.

This script is designed to show you how to achieve all three settings.  You can complete this task in just one command line.  Just take the code from one of the functions and plug in your values.  This code includes error checking in two areas that testing determined that an error could happen.

<#
===========================================================
Script Name: BasicGPOSettings.ps1
Author: Jason A. Yoder, MCT
Website: WWW.MCTExpert.com
Blogsite: WWW.MCTExpert.Blogspot.com
-----------------------------------------------------------
Script Purpose:
Demonstrate how to use PowerShell to change a basic
GPO Settings

-----------------------------------------------------------
Requirements:
- Must be ran on a Domain Controller or Windows 7 Client
  with RSAT installed.

- User must have the necessary permissions to modify
  the GPO.

-----------------------------------------------------------
Revision History:
Currently Version 1.0

-----------------------------------------------------------
Known Issues:
None.

-----------------------------------------------------------
#>
Set-StrictMode -version 2.0
# Variables:
# $GPOName: Holds the name of the Group Policy to be
# modified.
$GPOName = "GPO-Test"
# $ListKey : The registry key to be modified
$ListKey = "HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard"
# $ListValueName : TheValueName to be changed.
$ListValueName = "Auto Publishing"
# $Decision : Will record the users choice on when
# value to set in the GPO.
$Decision = 0
# $QuestionString : String to display the valid choices
# to the user.
$QuestionString = "Please select from the following: 'r
1) - Set the policy to `"Enable`" `r
2) - Set the policy to `"Disabled`" `r
3) - Set the policy to `"Not Configured`" `r
4) - Retrieve the current policy information`" `r
5) - Exit the script without making changes"

# =========================================================

# =========================================================
# Functions:

# Enable_Setting will set the GPO value to "Enabled"
Function Enable_Setting
    {
        Set-GPRegistryValue -Name $GPOName -Key $ListKey `
       -ValueName $ListValueName -Type DWORD -Value 1 
       Write-Host "The GPO value has been enabled."
    }
# Disable_Setting will set the GPO value to "Disabled"
Function Disable_Setting
    {
       
Set-GPRegistryValue -Name $GPOName -Key $ListKey `
       -ValueName $ListValueName -Type DWORD -Value 0  
        Write-Host "The GPO value has been disabled."
    }
   
# Get_Current_Value will display the current value for the GPO setting.
# Error handling is set should this value be set to "Not Configured."
# In a "Not Configured" state, the GPO value is not present and would
# otherwise error out.
Function Get_Current_Value
    {
        Try {Get-GPRegistryValue -Name $GPOName -Key `
        $ListKey -ErrorAction Stop}
        Catch { Write-Host "This GPO value is `"Not Configured`"."
                Write-Host "No data to return."}
    }
# NC_Setting will set the GPO value to "Disabled"
# Error handling is set should this value be set to "Not Configured."
# In a "Not Configured" state, the GPO value is not present and would
# otherwise error out.
Function NC_Setting
    {
        Write-Host "Setting the value to `"Not Configured`"."
        Try { Remove-GPRegistryValue -Name $GPOName -Key `
        $ListKey -ValueName $ListValueName -ErrorAction Stop}
        Catch { Write-Host "This GPO value is already set to `"Not Configured`"."}
    }
   
# == End of Functions : ===================================
# =========================================================
# Main Code:

# Announce the start of the script.
Clear-Host
Write-Host "=== Starting Script: BasicGPOSettings.ps1 ===" -foregroundcolor green

# Import the cmdlet needed for this operation from the
# GroupPolicy module
Import-Module GroupPolicy -cmdlet Set-GPRegistryValue, Remove-GPRegistryValue, Get-GPRegistryValue
# Display the users choices and record their decision in
# The variable $Decision.
$Decision = Read-Host ($QuestionString)
# Use the switch statement against $Decision to determine
# which function to execute.  Set the Switch statement to
# end on the first match. Set a DEFAULT value should the
# user select option 5 or provide an invalid input.
Switch ($Decision)
    {
        1 {Enable_Setting; Break}
        2 {Disable_Setting; Break}
        3 {NC_Setting; Break}
        4 {Get_Current_Value; Break}
        Default {"No Changes Made"; Break}
     }
    
# Announce the end of the script.
Write-Host "=== Ending Script: BasicGPOSettings.ps1 ===" -foregroundcolor green
# == End of Main Code =====================================

No comments: