Get-PSGPODirectory¶
Reads the domain, its OUs, GPOs and GPO links from Active Directory over LDAP.
The help of the command, as Get-Help Get-PSGPODirectory -Full gives it.
Syntax¶
Get-PSGPODirectory [[-Server] <string>] [[-Credential] <pscredential>] [[-Port] <int>] [-UseSsl] [<CommonParameters>]
Description¶
Reads the domain as GPMC shows it: the domain and its organizational units with their GPO links (gPLink, by link order, enforced and disabled links) and blocked inheritance (gPOptions), and the group policy containers (GPOs); and the sites of the forest with their links, read only (CN=Sites of the configuration: their links are changed with GPMC). Works with Windows and Samba domain controllers, from Windows and Linux, through System.DirectoryServices.Protocols.
The configuration of HGPM for the domain (Get-PSGPOConfiguration: SYSVOL\
As GPMC, the domain is read from its PDC emulator (the fSMORoleOwner of the domain), where the changes go, unless -Server gives another domain controller: a warning then says it, as the other domain controllers replicate the GPOs from the PDC emulator (and Samba does not replicate SYSVOL).
Its changes are written to the domain: NewGpo creates a GPO with New-GPO of RSAT on Windows (the GroupPolicy module), with samba-tool on Linux (Kerberos), NewLink links a GPO to the domain or an OU over LDAP. Pass it to Show-GPOManagerAvalonia -Directory to manage it in the window.
Authentication: - Windows: the identity of the session (Kerberos), or -Credential. - Linux: a Kerberos ticket (kinit user@REALM), which needs the SASL GSSAPI module (Debian/Ubuntu: libsasl2-modules-gssapi-mit); or -Credential with -UseSsl. A password is never sent over plain LDAP.
Parameters¶
-Server¶
Domain controller to read from: its DNS name (Kerberos needs the name, not the IP address). By default, the PDC emulator of the domain, found by the computer itself when it is a domain controller, else by a domain controller of the domain of the computer (Windows locates one); the domain controller found when the PDC emulator cannot be reached.
| Type | Required | Position | Default value | Accepts pipeline input |
|---|---|---|---|---|
String |
No | 1 | None | No |
-Credential¶
Account to read the directory with, instead of the current identity.
| Type | Required | Position | Default value | Accepts pipeline input |
|---|---|---|---|---|
PSCredential |
No | 2 | None | No |
-UseSsl¶
LDAPS (port 636). The certificate of the server must be trusted by the system.
| Type | Required | Position | Default value | Accepts pipeline input |
|---|---|---|---|---|
SwitchParameter |
No | Named | None | No |
-Port¶
LDAP port, when not 389 (636 with -UseSsl).
| Type | Required | Position | Default value | Accepts pipeline input |
|---|---|---|---|---|
Int32 |
No | 3 | 0 |
No |
Examples¶
Example 1¶
Example 2¶
# Linux, Samba AD: Kerberos ticket first
kinit administrator@HARDENBOX.LABO
Get-PSGPODirectory -Server dc.hardenbox.labo
Example 3¶
Outputs¶
GPOToolsDirectory