Get-PSGPODirectory¶

Reads the domain, its OUs, GPOs and GPO links from Active Directory over LDAP.

L'aide de la commande, telle que Get-Help Get-PSGPODirectory -Full la donne (en anglais).

Syntaxe¶

Get-PSGPODirectory [[-Server] <string>] [[-Credential] <pscredential>] [[-Port] <int>] [-UseSsl] [<CommonParameters>]

Description¶

Reads the domain as GPMC shows it: the domain and its organizational units with their GPO links (gPLink, by link order, enforced and disabled links) and blocked inheritance (gPOptions), and the group policy containers (GPOs); and the sites of the forest with their links, read only (CN=Sites of the configuration: their links are changed with GPMC). Works with Windows and Samba domain controllers, from Windows and Linux, through System.DirectoryServices.Protocols.

The configuration of HGPM for the domain (Get-PSGPOConfiguration: SYSVOL\\ PSGPOTools\Configuration.psd1) is read with it, and used from then on.

As GPMC, the domain is read from its PDC emulator (the fSMORoleOwner of the domain), where the changes go, unless -Server gives another domain controller: a warning then says it, as the other domain controllers replicate the GPOs from the PDC emulator (and Samba does not replicate SYSVOL).

Its changes are written to the domain: NewGpo creates a GPO with New-GPO of RSAT on Windows (the GroupPolicy module), with samba-tool on Linux (Kerberos), NewLink links a GPO to the domain or an OU over LDAP. Pass it to Show-GPOManagerAvalonia -Directory to manage it in the window.

Authentication: - Windows: the identity of the session (Kerberos), or -Credential. - Linux: a Kerberos ticket (kinit user@REALM), which needs the SASL GSSAPI module (Debian/Ubuntu: libsasl2-modules-gssapi-mit); or -Credential with -UseSsl. A password is never sent over plain LDAP.

Paramètres¶

-Server¶

Domain controller to read from: its DNS name (Kerberos needs the name, not the IP address). By default, the PDC emulator of the domain, found by the computer itself when it is a domain controller, else by a domain controller of the domain of the computer (Windows locates one); the domain controller found when the PDC emulator cannot be reached.

-Credential¶

Account to read the directory with, instead of the current identity.

-UseSsl¶

LDAPS (port 636). The certificate of the server must be trusted by the system.

-Port¶

LDAP port, when not 389 (636 with -UseSsl).

Exemples¶

Exemple 1¶

Show-GPOManagerAvalonia -Directory (Get-PSGPODirectory)

Exemple 2¶

# Linux, Samba AD: Kerberos ticket first
kinit administrator@HARDENBOX.LABO
Get-PSGPODirectory -Server dc.hardenbox.labo

Exemple 3¶

Get-PSGPODirectory -Server dc.contoso.com -Credential (Get-Credential) -UseSsl

Sorties¶

• GPOToolsDirectory

Voir aussi¶

• Toutes les commandes