@@ -48,9 +48,9 @@ Get-GPPermission -Name "TestGpo" -TargetName "Domain Users" -TargetType Group
48
48
```
49
49
50
50
``` Output
51
- Trustee : Domain Users
52
- TrusteeType : Group
53
- PermissionLevel : GpoRead
51
+ Trustee : Domain Users
52
+ TrusteeType : Group
53
+ PermissionLevel : GpoRead
54
54
Inherited : False
55
55
```
56
56
@@ -73,50 +73,50 @@ This command gets the permission level for the Domain Admins group on the GPO wi
73
73
` fa4a9473-6e2a-4b78-175e68d97bde ` in the ` Sales.Contoso.com ` domain. The ` DC1.sales.contoso.com `
74
74
domain controller is contacted to complete the operation.
75
75
76
- If the domain of the user that is running the session (or, for startup and shutdown scripts, the
77
- computer) is different from the sales.contoso.com domain, a trust must exist between the two
76
+ If the domain of the user that's running the session (or, for startup and shutdown scripts, the
77
+ computer) is different from the ` sales.contoso.com ` domain, a trust must exist between the two
78
78
domains, or the command fails.
79
79
80
80
### Example 3: Get the permission level for all security principals on the specified GPO
81
81
82
82
``` powershell
83
- Get-GPPermission -Name "TestGPO" -All
83
+ Get-GPPermission -Name "TestGPO" -All
84
84
```
85
85
86
86
``` Output
87
- Trustee : Authenticated Users
88
- TrusteeType : WellKnownGroup
89
- Permission : GpoApply
90
- Inherited : False
91
-
92
- Trustee : Domain Admins
93
- TrusteeType : Group
94
- Permission : GpoEditDeleteModifySecurity
95
- Inherited : False
96
-
97
- Trustee : Enterprise Admins
98
- TrusteeType : Group
99
- Permission : GpoEditDeleteModifySecurity
100
- Inherited : False
101
-
102
- Trustee : ENTERPRISE DOMAIN CONTROLLERS
103
- TrusteeType : WellKnownGroup
104
- Permission : GpoRead
105
- Inherited : False
106
-
107
- Trustee : SYSTEM
108
- TrusteeType : WellKnownGroup
109
- Permission : GpoEditDeleteModifySecurity
87
+ Trustee : Authenticated Users
88
+ TrusteeType : WellKnownGroup
89
+ Permission : GpoApply
90
+ Inherited : False
91
+
92
+ Trustee : Domain Admins
93
+ TrusteeType : Group
94
+ Permission : GpoEditDeleteModifySecurity
95
+ Inherited : False
96
+
97
+ Trustee : Enterprise Admins
98
+ TrusteeType : Group
99
+ Permission : GpoEditDeleteModifySecurity
100
+ Inherited : False
101
+
102
+ Trustee : ENTERPRISE DOMAIN CONTROLLERS
103
+ TrusteeType : WellKnownGroup
104
+ Permission : GpoRead
105
+ Inherited : False
106
+
107
+ Trustee : SYSTEM
108
+ TrusteeType : WellKnownGroup
109
+ Permission : GpoEditDeleteModifySecurity
110
110
Inherited : False
111
111
```
112
112
113
113
This command gets the permission level for each security principal that has permissions on the GPO
114
- named TestGPO.
114
+ named ` TestGPO ` .
115
115
116
116
### Example 4: Get the display name of each GPO for a specific permissions
117
117
118
118
``` powershell
119
- Get-GPO -All | ForEach-Object {
119
+ Get-GPO -All | ForEach-Object {
120
120
if ( $_ |
121
121
$params = @{
122
122
TargetName = 'contoso\Domain Admins'
@@ -130,26 +130,27 @@ Get-GPO -All | ForEach-Object {
130
130
```
131
131
132
132
``` Output
133
- Default Domain Policy
134
- TestGPO-1
135
- TestGPO-2 Default Domain Controllers Policy
136
- Internet Security
133
+ Default Domain Policy
134
+ TestGPO-1
135
+ TestGPO-2 Default Domain Controllers Policy
136
+ Internet Security
137
137
TestGPO
138
138
```
139
139
140
140
This command lists the display name of each GPO (in the domain) on which the specified security
141
141
principal has permissions.
142
142
143
- First, ` Get-GPO ` is used to retrieve all the GPOs in the domain (** Get-GPO -All** ). Then, the
144
- collection is piped into the ` Foreach-Object ` command. As each GPO is evaluated, it is piped into
145
- ` Get-GPPermissions ` . If a permission level is returned, the DisplayName property of the GPO is
146
- printed ($ _ .DisplayName) .
143
+ First, ` Get-GPO ` is used to retrieve all the GPOs in the domain (` Get-GPO -All ` ). Then, the
144
+ collection is piped into the ` Foreach-Object ` command. As each GPO is evaluated, it's piped into
145
+ ` Get-GPPermissions ` . If a permission level is returned, the ** DisplayName** property of the GPO is
146
+ printed.
147
147
148
- Note: The ErrorAction parameter is set to SilentlyContinue for Get-GPPermissions. This is because a
149
- non-terminating error occurs if the specified security principal does not have permissions on the
150
- GPO. Specifying the ErrorAction as SilentlyContinue prevents the error messages from being printed
151
- for GPOS on which the security principal does not have permissions. For more information about the
152
- ErrorAction parameter, see about_CommonParameters.
148
+ The ** ErrorAction** parameter is set to ` SilentlyContinue ` . This is because a non-terminating error
149
+ occurs if the specified security principal doesn't have permissions on the GPO. Specifying the
150
+ ** ErrorAction** as ` SilentlyContinue ` prevents the error messages from being printed for GPOS on
151
+ which the security principal doesn't have permissions. For more information about the
152
+ ** ErrorAction** parameter, see
153
+ [ about_CommonParameters] ( https://go.microsoft.com/fwlink/?LinkID=113216 ) .
153
154
154
155
## PARAMETERS
155
156
@@ -161,7 +162,7 @@ permissions on the GPO.
161
162
``` yaml
162
163
Type : System.Management.Automation.SwitchParameter
163
164
Parameter Sets : (All)
164
- Aliases :
165
+ Aliases :
165
166
166
167
Required : False
167
168
Position : Named
@@ -172,17 +173,14 @@ Accept wildcard characters: False
172
173
173
174
### -DomainName
174
175
175
- Specifies the domain for this cmdlet.
176
- You must specify the fully qualified domain name (FQDN) of the domain.
176
+ Specifies the domain for this cmdlet. You must specify the fully qualified domain name (FQDN) of the
177
+ domain. The GPO specified must exist in this domain.
177
178
178
- For the ` Get-GPPermission` cmdlet, the GPO for which to get the permission level must exist in
179
- this domain.
180
-
181
- If you do not specify the **Domain** parameter, the domain of the user that is running the current
179
+ If you don't specify the **Domain** parameter, the domain of the user that's running the current
182
180
session is used. If the cmdlet is being run from a computer startup or shutdown script, the domain
183
181
of the computer is used. For more information, see the Notes section in the full Help.
184
182
185
- If you specify a domain that is different from the domain of the user that is running the current
183
+ If you specify a domain that's different from the domain of the user that's running the current
186
184
session (or, for a startup or shutdown script, the computer), a trust must exist between that domain
187
185
and the domain of the user or the computer.
188
186
@@ -204,7 +202,7 @@ Accept wildcard characters: False
204
202
### -Guid
205
203
206
204
Specifies the GPO from which to retrieve the permission level by its globally unique identifier
207
- (GUID). The GUID uniquely identifies the GPO.
205
+ (GUID). The ` GUID` uniquely identifies the GPO.
208
206
209
207
You can also refer to the **Guid** parameter by its built-in alias, **Id**. For more information,
210
208
see [about_Aliases](/powershell/module/microsoft.powershell.core/about/about_aliases).
@@ -225,7 +223,7 @@ Accept wildcard characters: False
225
223
226
224
Specifies the GPO from which to retrieve the permission level by its display name.
227
225
228
- The display name is not guaranteed to be unique in the domain. If another GPO with the same display
226
+ The display name isn't guaranteed to be unique in the domain. If another GPO with the same display
229
227
name exists in the domain an error occurs. You can use the **Guid** parameter to uniquely identify a
230
228
GPO.
231
229
@@ -249,7 +247,7 @@ Accept wildcard characters: False
249
247
Specifies the name of the domain controller that this cmdlet contacts to complete the operation. You
250
248
can specify either the fully qualified domain name (FQDN) or the host name.
251
249
252
- If you do not specify the name by using the **Server** parameter, the PDC emulator is contacted.
250
+ If you don't specify the name using the **Server** parameter, the PDC emulator is contacted.
253
251
254
252
You can also refer to the **Server** parameter by its built-in alias, **DC**. For more information,
255
253
see [about_Aliases](/powershell/module/microsoft.powershell.core/about/about_aliases).
@@ -274,16 +272,14 @@ security principal (domain\account) or just its name.
274
272
275
273
For instance, in the `contoso.com` domain, to specify :
276
274
277
- - The user someuser, use `contoso\someuser` or `someuser`.
278
-
275
+ - The username, use `contoso\someuser` or `someuser`.
279
276
- The Domain Admins security group, use `contoso\Domain Admins` or `Domain Admins`.
280
-
281
- - The computer computer-01, use `contoso\computer-01` or `computer-01`.
277
+ - The computer name, use `contoso\computer-01` or `computer-01`.
282
278
283
279
` ` ` yaml
284
280
Type: System.String
285
281
Parameter Sets: (All)
286
- Aliases:
282
+ Aliases:
287
283
288
284
Required: False
289
285
Position: Named
@@ -294,20 +290,17 @@ Accept wildcard characters: False
294
290
295
291
# ## -TargetType
296
292
297
- The type of security principal for which to get the permission level.
298
-
299
- The acceptable values for this parameter are :
293
+ The type of security principal for which to get the permission level. The acceptable values for this
294
+ parameter are :
300
295
301
296
- Computer
302
-
303
297
- User
304
-
305
298
- Group
306
299
307
300
` ` ` yaml
308
301
Type: PermissionTrusteeType
309
302
Parameter Sets: (All)
310
- Aliases:
303
+ Aliases:
311
304
Accepted values: Computer, User, Group
312
305
313
306
Required: False
@@ -333,26 +326,26 @@ GPOs from different domains are not supported.
333
326
334
327
# # OUTPUTS
335
328
336
- # ##
329
+ # ## Microsoft.GroupPolicy.GPPermissionCollection
330
+
331
+ # ## Microsoft.GroupPolicy.GPPermission
337
332
338
333
This cmdlet returns an object that represents permissions for the specified security principal
339
334
(user, group, or computer) on the GPO.
340
335
341
336
# # NOTES
342
337
343
- * You can use the *DomainName* parameter to explicitly specify the domain for this cmdlet.
344
-
345
- If you do not explicitly specify the domain, the cmdlet uses the default domain. The default
346
- domain is the domain that is used to access network resources by the security context under which
347
- the current session is running. This domain is typically the domain of the user that is running
348
- the session. For example, the domain of the user who started the session by opening Windows
349
- PowerShell or the domain of a user that is specified in a runas command. However, computer startup
350
- and shutdown scripts run under the context of the LocalSystem account. The LocalSystem account is
351
- a built-in local account, and it accesses network resources under the context of the computer
352
- account. Therefore, when this cmdlet is run from a startup or shutdown script, the default domain
353
- is the domain to which the computer is joined.
338
+ You can use the **DomainName** parameter to explicitly specify the domain for this cmdlet. If you do
339
+ not explicitly specify the domain, the cmdlet uses the default domain. The default domain is the
340
+ domain that is used to access network resources by the security context under which the current
341
+ session is running. This domain is typically the domain of the user that is running the session. For
342
+ example, the domain of the user who started the session by opening Windows PowerShell or the domain
343
+ of a user that is specified in a runas command. However, computer startup and shutdown scripts run
344
+ under the context of the LocalSystem account. The LocalSystem account is a built-in local account,
345
+ and it accesses network resources under the context of the computer account. Therefore, when this
346
+ cmdlet is run from a startup or shutdown script, the default domain is the domain to which the
347
+ computer is joined.
354
348
355
349
# # RELATED LINKS
356
350
357
351
[Set-GPPermission](./Set-GPPermission.md)
358
-
0 commit comments