Get-PSGPOPolicyRuleSet¶

Reads rule sets of Policy Analyzer (.PolicyRules), or makes one from GPOs.

The help of the command, as Get-Help Get-PSGPOPolicyRuleSet -Full gives it.

Syntax¶

Get-PSGPOPolicyRuleSet [-Path] <string[]> [<CommonParameters>]
Get-PSGPOPolicyRuleSet -GpmcBackupPath <string> [-Name <string[]>] [-SetName <string>] [<CommonParameters>]
Get-PSGPOPolicyRuleSet -Name <string[]> [-SetName <string>] [-Directory <GPOToolsDirectory>] [-Server <string>] [<CommonParameters>]
Get-PSGPOPolicyRuleSet -Backup <Backup[]> [-SetName <string>] [<CommonParameters>]
Get-PSGPOPolicyRuleSet -Container <string> [-SetName <string>] [-Directory <GPOToolsDirectory>] [-Server <string>] [<CommonParameters>]
Get-PSGPOPolicyRuleSet -EffectiveState -RuleSet <GPOToolsPolicyRuleSet[]> [-SetName <string>] [<CommonParameters>]

Description¶

A rule set holds the settings of one or more GPOs, as the Policy Analyzer of the Microsoft Security Compliance Toolkit keeps them in a .PolicyRules file: the registry settings of their Registry.pol files (computer and user), their security template (GptTmpl.inf), their advanced audit policy (audit.csv) and their client-side extensions.

It is read from .PolicyRules files (those of the security baselines of Microsoft, or of Policy Analyzer), or made from GPOs: of the domain, of backups of HGPM (Get-PSGPOBackup) or of GPMC (the GPOs folder of a security baseline), as GPO2PolicyRules.exe does. Compare-PSGPOPolicyRuleSet compares sets, Export-PSGPOPolicyRuleSet saves one.

With -Container, the set is made of the GPOs that apply to a domain or an OU, in their order of precedence as the Group Policy Inheritance tab of GPMC lists them (the enforced links first, from the domain down, then the others from the OU up until an OU that blocks the inheritance; the links disabled and the parts a GPO status disables left out): each setting then has the precedence of its GPO, and Compare-PSGPOPolicyRuleSet shows the value that wins. The security filtering, the WMI filters and the loopback processing are those of each computer or user, not taken into account.

With -EffectiveState, the set is the state of this computer for the settings of -RuleSet, as "Compare to Effective State" of Policy Analyzer reads it (Windows): the registry of the computer and of the user of the session (the security options and the startup of the services included), the other security settings (secedit /export) and the advanced audit policy (auditpol /backup). A setting the computer does not have is not in the set. secedit and auditpol need PowerShell run as an administrator: without, their settings are left out, with a warning. The set is named as Policy Analyzer names it, EffectiveState__.

Parameters¶

-Path¶

Files of Policy Analyzer (.PolicyRules), or folders: the .PolicyRules files they hold. One set per file, named after it.

Type	Required	Position	Default value	Accepts pipeline input
`String[]`	Yes	1	None	No

-Name¶

Display names of the GPOs (* and ? make a pattern): of the domain, or of the backups of -GpmcBackupPath (all of them by default).

Type	Required	Position	Default value	Accepts pipeline input
`String[]`	No	Named	None	No

-Backup¶

Backups of HGPM (Get-PSGPOBackup).

Type	Required	Position	Default value	Accepts pipeline input
`Object[]`	Yes	Named	None	Yes

-GpmcBackupPath¶

A folder of backups (alias -BackupPath): of GPMC (Backup-GPO, the GPOs folder of a security baseline, or one backup), or of HGPM (the folder of Backup-PSGPO, the newest backup of each GPO; the folder of a GPO; one backup, or its Files folder).

Type	Required	Position	Default value	Accepts pipeline input
`String`	Yes	Named	None	No

-Container¶

A domain or an OU: its distinguished name, the name of the domain, or the name of an OU when only one OU has it. The set holds the GPOs that apply to it, by precedence.

Type	Required	Position	Default value	Accepts pipeline input
`String`	Yes	Named	None	No

-EffectiveState¶

The effective state of this computer for the settings of -RuleSet.

Type	Required	Position	Default value	Accepts pipeline input
`SwitchParameter`	Yes	Named	None	No

-RuleSet¶

With -EffectiveState: the sets whose settings are read on the computer (the baselines).

Type	Required	Position	Default value	Accepts pipeline input
`GPOToolsPolicyRuleSet[]`	Yes	Named	None	No

-SetName¶

Name of the set made from GPOs: by default the name of the GPO when there is one, else the name of the domain or of the folder; " (precedence)" with -Container; EffectiveState__ with -EffectiveState.

Type	Required	Position	Default value	Accepts pipeline input
`String`	No	Named	None	No

-Directory¶

Directory of the domain (Get-PSGPODirectory); the domain is read when not given.

Type	Required	Position	Default value	Accepts pipeline input
`GPOToolsDirectory`	No	Named	None	No

-Server¶

Domain controller to read the domain from, without -Directory.

Type	Required	Position	Default value	Accepts pipeline input
`String`	No	Named	None	No

Examples¶

Example 1¶

Get-PSGPOPolicyRuleSet -Path "$HOME\Documents\PolicyAnalyzer"

Example 2¶

Get-PSGPOPolicyRuleSet -Name 'Tier 1 - Servers*' -SetName 'Production'

Example 3¶

Get-PSGPOPolicyRuleSet -GpmcBackupPath '.\Windows 11 v25H2 Security Baseline\GPOs'

Example 4¶

# What the computers of an OU get, against the baseline of Microsoft
$ou = Get-PSGPOPolicyRuleSet -Container 'OU=Workstations,DC=contoso,DC=com'
Compare-PSGPOPolicyRuleSet -RuleSet (Get-PSGPOPolicyRuleSet .\MSFT-Win11-v25H2.PolicyRules), $ou -DifferenceOnly

Example 5¶

# This computer against the baseline of Microsoft (PowerShell run as an administrator)
$baseline = Get-PSGPOPolicyRuleSet .\MSFT-Win11-v25H2.PolicyRules
$state = Get-PSGPOPolicyRuleSet -EffectiveState -RuleSet $baseline
Compare-PSGPOPolicyRuleSet -RuleSet $baseline, $state -DifferenceOnly
Export-PSGPOPolicyRuleSet -RuleSet $state -Path ".\$($state.Name).PolicyRules"

Example 6¶

Get-PSGPOBackup -Path /srv/gpo-backups -Name 'Default Domain Policy' | Select-Object -First 1 | Get-PSGPOPolicyRuleSet

Outputs¶

GPOToolsPolicyRuleSet