Skip to content

Commands

Each command has its page, its help with its parameters and examples: click its name. Get-Help <command> -Full gives the same help in PowerShell, and Get-Help <command> -Online opens its page. The commands that change the domain support -WhatIf and -Confirm. The parameters that take an account (-ApplyTo, -DenyTo, -Account) complete the well-known accounts with Tab.

The domain

Command Does
Get-PSGPODirectory [-Server] [-Credential] [-UseSsl] [-Port] reads the domain over LDAP: its OUs, GPOs, links, the rights of the account, the configuration of the domain and its approval workflow
Import-PSGPODirectory -Path reads a domain from a JSON description (offline, demonstrations, tests)
Show-GPOManagerAvalonia [-Server] [-Credential] [-UseSsl] [-Directory] [-NoDirectory] [-PolicyDefinitions] [-UICulture] [-Language] opens the console
Get-PSGPOConfiguration [-Directory] [-Server] the configuration in use, and where it comes from
Test-PSGPOHealth [-Name] [-Directory] [-Server] [-DomainController] checks the GPOs as GPMC and gpotool: their folder and versions in SYSVOL, their client-side extensions, the folders without a GPO, the links, and their replication on each domain controller
Test-PSGPOSecurityPosture [-Directory] [-Server] [-SystemLog] checks who can create, change and link GPOs beyond the Tier 0 and the workflow, and who owns the folders of SYSVOL the computers and the consoles read; the High findings to the log of the system
Get-PSGPOReplicationStatus [-Name] [-Directory] [-Server] [-DomainController] compares the GPOs of each domain controller, in its directory and its SYSVOL, to the baseline, as the Status tab of GPMC

GPOs

Command Does
Find-PSGPO [-Name] [-Id] [-LinkedTo] [-Linked\|-NotLinked] [-WmiFilter] [-Account [-Permission]] [-Extension] [-Setting] [-Status] [-ApprovalState] [-Comment] searches the GPOs, as the Search of GPMC
New-PSGPO -Name [-Template\|-StarterGpo] [-Status Enabled\|ComputerOnly\|UserOnly] [-Comment] creates a GPO, empty, from a template or from a Starter GPO
Copy-PSGPO -Name -TargetName [-CopyAcl] copies a GPO into a new GPO of its domain, as Copy and Paste of GPMC: its settings, status, WMI filter and comment, not its links
Get-PSGPOStarterGpo [-Name] the Starter GPOs of the domain, System and Custom
New-PSGPOStarterGpo -Name [-Description] [-FromGpo] creates a Starter GPO, empty or with the Administrative Templates of a GPO
Remove-PSGPOStarterGpo -Name deletes Custom Starter GPOs
Get-PSGPOModeling [-Computer] [-ComputerGroup] [-User] [-UserGroup] [-Site] [-Loopback] [-FalseWmiFilter] the GPOs a computer and a user would apply, from the directory, as Group Policy Modeling of GPMC
Get-PSGPOResult [-ComputerName] [-User] [-Scope] [-Path] what a computer and a user applied, as Group Policy Results (gpresult, samba-gpupdate --rsop)
Invoke-PSGPOUpdate [-ComputerName] [-Target] [-User] [-Force] has computers apply their GPOs now (gpupdate, Invoke-GPUpdate, samba-gpupdate)
Remove-PSGPO -Name [-BackupPath] [-NoBackup] deletes GPOs and their links, backed up first
Approve-PSGPO -Name [-CreatorRights ReadOnly\|EditSettings] [-ApplyTo] [-DenyTo] [-CreateFilteringGroups] [-GroupContainer] [-BackupPath] approves GPOs waiting for their approval, with their security filtering (and its groups)
Initialize-PSGPOWorkflow [-Apply] checks, and with -Apply sets, the delegation of the creation of GPOs to the creators, once the central store exists
New-PSGPOLink -Name -Target [-Enforced] [-Disabled] links GPOs to the domain or an OU, with the lowest precedence
Set-PSGPOLink -Name -Target [-Enabled] [-Enforced] [-Order] enables, disables, enforces or moves links
Remove-PSGPOLink -Name -Target deletes links, the GPOs kept
Set-PSGPOInheritance -Target -Blocked blocks the inheritance of the domain or an OU, or not
Get-PSGPOInheritance -Target the links of the domain or an OU by link order, and the GPOs that apply there by precedence, as the tabs of GPMC
Set-PSGPO -Name [-NewName] [-Status Enabled\|ComputerOnly\|UserOnly\|Disabled] [-WmiFilter] [-NoWmiFilter] [-Comment] renames a GPO, sets the status, the WMI filter and the comment of GPOs
Get-PSGPOPermission -Name the permissions of GPOs, as the Delegation tab of GPMC: each account and its level
Get-PSGPOReport -Name, -All [-ReportType Object\|Xml\|Html] [-Path] the report of GPOs, as Get-GPOReport of GPMC: details, links, delegation, settings, and what HGPM does not interpret
Set-PSGPOPermission -Name -Account [-Permission GpoRead\|GpoApply\|GpoEdit\|GpoEditDeleteModifySecurity\|None] [-SecurityFiltering Add\|Remove] gives an account a level on GPOs, or changes their security filtering, in the directory and in SYSVOL
Get-PSGPOWmiFilter [-Name] the WMI filters of the domain, their queries and their GPOs
New-PSGPOWmiFilter -Name -Query [-Namespace] [-Description] creates a WMI filter
Set-PSGPOWmiFilter -Name [-NewName] [-Description] [-Query] [-Namespace] changes the name, description or queries of a WMI filter
Remove-PSGPOWmiFilter -Name deletes WMI filters no GPO uses
Export-PSGPOWmiFilter -Name -Path [-Force], -InputObject -Path [-Domain] exports WMI filters to .mof files, as GPMC does; with -InputObject, filters written without a domain
Import-PSGPOWmiFilter -Path [-Name] creates WMI filters from .mof files of GPMC or HGPM
Get-PSGPOWmiFilterPermission [-Name] who creates WMI filters (without -Name), who changes each filter, as the Delegation tabs of GPMC
Show-WmiFilterCreatorAvalonia [-Path] [-Server] [-Credential] [-UseSsl] [-Language] opens the WMI filter creator: ready-made queries, query builder, check, test, .mof export, creation in the domain
Get-PSGPOWmiQueryTemplate [-Id] [-Category] [-Value] the ready-made WQL queries of the creator, their parameters filled
Test-PSGPOWmiFilter -Query [-Namespace], -InputObject, -Path [-ComputerName] [-Credential] tests a WMI filter on a computer, as Windows evaluates it (Windows)
Set-PSGPOWmiFilterPermission [-Name] -Account -Permission WmiCreate\|WmiEdit\|WmiFullControl\|None delegates the creation of the WMI filters, or the change of a filter, with the ACEs of GPMC

A name given with -Name is the name of the GPO, brackets included (Servers [Lyon]); with * or ? it is a wildcard pattern. Two GPOs with the same name are each taken.

-Directory (from Get-PSGPODirectory) or -Server gives the domain to each of them; without them, the domain of the computer is read.

$Directory = Get-PSGPODirectory -Server dc.hardenbox.labo
New-PSGPO -Directory $Directory -Name 'T1 - Servers - Proxy' -Status ComputerOnly
Approve-PSGPO -Directory $Directory -Name 'T1 - Servers - Proxy' -ApplyTo 'APPLY_T1 - Servers - Proxy'

Backups

Command Does
Backup-PSGPO -Path [-Name] [-Comment] [-Label] [-Approve] [-Force] backs up the GPOs that changed since their last backup
Get-PSGPOBackup -Path [-Name] [-Id] [-Label] [-Approved] [-Template] [-Deleted] lists the backups, newest first; -Deleted: the recycle bin
Compare-PSGPOBackup -ReferenceBackup -DifferenceBackup what changed between two backups, setting by setting
Restore-PSGPO -Backup [-NoBackup] [-RestoreLink] puts a GPO back as a backup has it, or creates a deleted GPO again
Remove-PSGPOBackup -Backup deletes for good a GPO of the recycle bin: all its backups
Set-PSGPOBackup -Backup [-Comment] [-AddLabel] [-RemoveLabel] [-Approve] [-Unapprove] changes the notes of a backup
Get-PSGPODrift -Path [-Name] [-Label] compares each GPO to its approved version: InSync, Drifted, NotApproved
Get-PSGPOAuditLog [-Path] [-Domain] [-Name] [-Action] [-Account] [-After] [-Before] what the consoles and the commands changed in the domain, newest first
Show-AuditLogAvalonia [-Path] [-Directory \| -Server] [-Language] opens the audit log in a window: filtered by period, domain, action and a search, the details of a change, the changes shown exported to CSV
Initialize-PSGPOAuditShare [-Path] [-Directory \| -Server] prepares the share of the central audit log: a folder per tier, the permissions of the roles
Initialize-PSGPOBackupShare [-Path] [-Directory \| -Server] prepares the share of the central backups: for Tier 0 only
Import-PSGPOAuditLog -Path [-Destination] [-Remove] moves the log of a console into the central log, each change in the folder of the tier of its account
Invoke-PSGPOAuditRetention [-Path] [-RetentionMonths] [-Directory \| -Server] archives the months of the audit log older than its retention, then deletes their files
Register-PSGPOEventSource registers the event source HGPM of the Windows event log, once per computer
Get-PSGPOGpmcBackup -Path [-Name] the backups of GPMC (Backup-GPO) of a folder
Import-PSGPO -Path -TargetName [-SourceName] [-BackupId] [-MigrationTable] [-Exclusive] [-CreateIfNeeded] [-BackupPath] [-NoBackup] imports the settings of a backup (GPMC or HGPM) into a GPO, with a migration table
Get-PSGPOMigrationEntry -Path [-Name] [-IncludePermission] the accounts and UNC paths the settings of backups reference
New-PSGPOMigrationTable -Path -BackupPath [-Name] [-IncludePermission] [-MapByRelativeName] [-Force] writes a migration table (.migtable) for backups, as GPMC writes it
Get-PSGPOMigrationTable -Path reads a migration table of GPMC, checked 
Backup-PSGPO -Path /srv/gpo-backups -Comment 'Nightly'
Get-PSGPODrift -Path /srv/gpo-backups | Where-Object State -EQ 'Drifted' | ForEach-Object Changes

Policy Analyzer

Command Does
Show-PolicyAnalyzerAvalonia [-Path] [-Directory \| -Server] [-PolicyDefinitions] [-Language] opens Policy Analyzer: rule sets compared in a window, as Policy Analyzer does
Get-PSGPOPolicyRuleSet -Path \| -Name \| -Backup \| -GpmcBackupPath [-SetName] reads .PolicyRules files (the security baselines of Microsoft), or makes a rule set from GPOs of the domain, backups of HGPM or GPMC
Compare-PSGPOPolicyRuleSet -RuleSet [-DifferenceOnly] [-ConflictOnly] compares rule sets setting by setting, a column per set, as Policy Analyzer does
Export-PSGPOPolicyRuleSet -RuleSet -Path [-Force] saves rule sets as a .PolicyRules file, which Policy Analyzer and LGPO.exe /p read
Export-PSGPOPolicyRuleComparison -InputObject -Path [-All] [-Force] saves a comparison as an Excel workbook, with the colours of Policy Analyzer
Import-PSGPOPolicyRuleSet -RuleSet -TargetName [-PolicyName] [-Replace] [-CreateIfNeeded] [-BackupPath] [-NoBackup] writes the settings of a rule set in a GPO of the domain, as LGPO.exe /p applies it to a computer 
$baseline = Get-PSGPOPolicyRuleSet -Path .\MSFT-Win11-v25H2.PolicyRules
$domain = Get-PSGPOPolicyRuleSet -Name 'Workstations - *' -SetName 'Domain'
Compare-PSGPOPolicyRuleSet -RuleSet $baseline, $domain -DifferenceOnly | Export-PSGPOPolicyRuleComparison -Path ./Differences.xlsx

Administrative templates

Command Does
Initialize-PSGPOAdmx -Path [-UICulture] loads the ADMX and ADML files of a folder (local PolicyDefinitions or the central store)
Install-PSGPOAdmx [-UICulture] [-AllLanguages] [-Path] [-CentralStore] [-MsiPath] [-Force] installs the ADMX files of Windows from the package of Microsoft (checked), into a folder or the central store of the domain
Get-PSGPOPolicy [-Scope Machine\|User] the policies loaded
Get-PSGPOCategory their categories
Get-PSGPOSupportedOn the platforms they support 
Initialize-PSGPOAdmx -Path C:\Windows\PolicyDefinitions -UICulture en-US
Get-PSGPOPolicy -Scope Machine | Where-Object DisplayName -Like '*biometrics*' | Select-Object DisplayName, Registry

The module

Command Does
Start-HGPM [-Language] opens the launcher: a tile for each tool of HGPM
Test-PSGPOUpdate [-Prerelease] [-Quiet] [-Repository] tells whether a newer version of HGPM is on the PowerShell Gallery, and the command that installs it

Password policies

Command Does
Show-PSOManagerAvalonia [-Server] [-Credential] [-UseSsl] [-View Policies\|Resultant] [-Language] opens the console of the fine-grained password policies (PSO)
Get-PSGPOFineGrainedPasswordPolicy [-Name] the PSOs of the domain, by order of priority, with the users and groups they apply to
Get-PSGPODefaultPasswordPolicy the password policy of the domain, for the accounts no PSO applies to
New-PSGPOFineGrainedPasswordPolicy -Name -Precedence [-MinPasswordLength] [-MaxPasswordAge] [-LockoutThreshold] [-AppliesTo]... creates a PSO, with the settings of the Administrative Center by default
Set-PSGPOFineGrainedPasswordPolicy -Name [-NewName] [-Precedence] [-ProtectedFromAccidentalDeletion]... changes, renames, protects PSOs
Remove-PSGPOFineGrainedPasswordPolicy -Name deletes PSOs not protected from accidental deletion
Add-PSGPOFineGrainedPasswordPolicySubject -Name -Subject applies PSOs to users and groups
Remove-PSGPOFineGrainedPasswordPolicySubject -Name -Subject stops applying them
Get-PSGPOResultantPasswordPolicy -Identity the PSO that applies to a user or a group, and why the others do not 
New-PSGPOFineGrainedPasswordPolicy -Name 'PSO - Tier 1 Admins' -Precedence 10 -MinPasswordLength 16 -AppliesTo 'GPO-Tier1-Admins'
(Get-PSGPOResultantPasswordPolicy -Identity tiers1).Candidates | Format-Table Order, Name, Precedence, AppliesThrough, Status

What they return

Type From Main properties
GPOToolsDirectory Get-PSGPODirectory, Import-PSGPODirectory DomainName, Domain, Gpos, Account, CanCreateGpo, Workflow
GPOToolsGpo .Gpos, New-PSGPO DisplayName, Id, Version, Flags, SecurityFiltering, DeniedTo, CanEdit, Owner, ApprovalState, RemovedAtApproval, WmiFilterId
PSGPOTools.GpoReport Get-PSGPOReport DisplayName, Id, Status, Links, Permissions, Extensions, Computer, User, NotInterpreted
PSGPOTools.Permission Get-PSGPOPermission, Set-PSGPOPermission GpoName, GpoId, Trustee, Sid, Permission, Inherited, Denied
PSGPOTools.Backup Backup-PSGPO, Get-PSGPOBackup Path, Id, DisplayName, BackedUp, BackedUpBy, Modified, Comment, Labels, Files
PSGPOTools.SettingChange Compare-PSGPOBackup, Get-PSGPODrift Change, Scope, Path, Name, Before, After
GPOToolsPolicyRuleSet Get-PSGPOPolicyRuleSet Name, Path, Rules, Extensions, GetPolicyNames()
PSGPOTools.PolicyRuleComparison Compare-PSGPOPolicyRuleSet Scope, Path, Name, Option, a property per set, Conflict, Difference, PolicyType, Group, Setting, Explain, Cells
PSGPOTools.Drift Get-PSGPODrift DisplayName, State, Approved, ApprovedBy, Changes
PSGPOTools.HealthFinding Test-PSGPOHealth Severity, Check, Target, Id, DomainController, Detail
PSGPOTools.PostureFinding Test-PSGPOSecurityPosture Severity, Check, Target, Principal, Detail
PSGPOTools.GpoInheritance Get-PSGPOInheritance Name, ContainerType, Path, GpoInheritanceBlocked, GpoLinks, InheritedGpoLinks
PSGPOTools.ReplicationStatus Get-PSGPOReplicationStatus DomainController, IsBaseline, DisplayName, Id, State, DirectoryVersion, SysvolVersion, BaselineVersion, Detail
PSGPOTools.Restore Restore-PSGPO DisplayName, Id, Version, BackupBefore, CreatedAgain, Linked, Problems
PSGPOTools.RemovedBackup Remove-PSGPOBackup DisplayName, Id, Backups, Templates, Path
PSGPOTools.Link New-PSGPOLink, Set-PSGPOLink DisplayName, Target, Order, Enabled, Enforced
PSGPOTools.AuditEntry Get-PSGPOAuditLog Time, Account, Computer, Server, Action, Target, GpoName, GpoId, Details
PSGPOTools.WmiFilter Get-PSGPOWmiFilter, New-PSGPOWmiFilter, Set-PSGPOWmiFilter Name, Id, Description, Queries, Gpos, DistinguishedName
PSGPOTools.Approval Approve-PSGPO DisplayName, Owner, CreatedBy, CreatorRights, AppliedBy, DeniedTo, GroupsCreated, RemovedPermissions, Backup