2 min read

Find Group Policy Objects with specific keywords using PowerShell

Find Group Policy Objects with specific keywords using PowerShell
Find Group Policy Objects with specific keywords using PowerShell

During different assessment projects, we need to analyze Active Directory Group Policy objects. If you have many Active Directory forests and domains, doing one-by-one manual checks isn't an option. Luckily we have can use PowerShell to simplify the process.

For the automated search based on our keyword, we can use two different commands:

  • Get-GPO
  • Get-GPOReport

Get-GPO allows us to retrieve all the Group Policy Objects from our environment. The Get-GPOReports command allows querying the GPO content in an XML format.

If the content is in XML format, then we can use the Contains method or -match operator.

Putting all these together, we can create a script like that.

Param(
    [Parameter(Mandatory=$True,HelpMessage = "Please speficy keyword for GPO search")]
        $KeyWord
)

$GPOs = Get-GPO -All
foreach($GPO in $GPOs){
    Write-Output -InputObject "**** Processing $($GPO.DisplayName) GPO"
    $GPOData = Get-GPOReport -Name $GPO.DisplayName -ReportType Xml
    If($GPOData.Contains($KeyWord)){
        Write-Output -InputObject "-------- We found something in $($GPO.DisplayName) Group Policy"
    }
    Else{
        #Write-Output -InputObject "--- We didnt find anything. Please try again with a different Keyword"
    }
    
}

Script output

Check out my GitHub page and click subscribe to get the latest news to your inbox.

Active-Directory/Find-GPOWithSpecificKeyWords.ps1 at master · Kaidja/Active-Directory
Active Directory. Contribute to Kaidja/Active-Directory development by creating an account on GitHub.