Windows Group Policy Management PowerShell Cheat Sheet

$PSVersionTable | Select-Object PSEdition, PSVersion
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber
Get-Module -ListAvailable GroupPolicy | Select-Object Name, Version, Path
[System.Security.Principal.WindowsIdentity]::GetCurrent().Name
Get-CimInstance Win32_ComputerSystem | Select-Object Name, Domain, PartOfDomain
Get-GPO -All -Domain 'corp.example.com' -Server 'dc01.corp.example.com' |
  Select-Object -First 1 DomainName, Owner, Id

$domain = 'corp.example.com'
$server = 'dc01.corp.example.com'
$reportDir = 'C:\Reports\GPO'
$gpo = Get-GPO -Name 'Pilot - Example Policy' -Domain $domain -Server $server
$gpo | Select-Object DisplayName, Id, DomainName, Owner, GpoStatus, `
  CreationTime, ModificationTime, UserVersion, ComputerVersion
Get-GPOReport -Guid $gpo.Id -ReportType Html `
  -Path (Join-Path $reportDir 'Pilot-GPO.html') -Domain $domain -Server $server
Get-GPOReport -Guid $gpo.Id -ReportType Xml `
  -Path (Join-Path $reportDir 'Pilot-GPO.xml') -Domain $domain -Server $server

Note: Create and ACL the report directory first. Reports can expose security configuration and should be stored as sensitive administrative records.

$domain = 'corp.example.com'
$server = 'dc01.corp.example.com'
$backupPath = 'C:\GPOBackups'
$gpo = Get-GPO -Name 'Pilot - Example Policy' -Domain $domain -Server $server
Get-GPOReport -Guid $gpo.Id -ReportType Xml -Domain $domain -Server $server `
  -Path 'C:\Reports\Pilot-GPO-before.xml'
Backup-GPO -Guid $gpo.Id -Path $backupPath -Domain $domain -Server $server `
  -Comment 'CHG-12345 before approved change' -WhatIf

Note: After approval, remove WhatIf only when the existing destination is protected, writable, monitored, and covered by a tested restore procedure.

$domain = 'corp.example.com'
$name = 'Pilot - Example Policy'
New-GPO -Name $name -Comment 'CHG-12345; owner: Endpoint; pilot only' `
  -Domain $domain -Server 'dc01.corp.example.com' -WhatIf

# After the GPO is approved and actually created, resolve its GUID before editing.
$gpo = Get-GPO -Name $name -Domain $domain -Server 'dc01.corp.example.com'
$key = 'HKLM\Software\Policies\Example'
Get-GPRegistryValue -Guid $gpo.Id -Key $key -ValueName 'Mode' `
  -Domain $domain -ErrorAction SilentlyContinue
Set-GPRegistryValue -Guid $gpo.Id -Key $key -ValueName 'Mode' `
  -Type DWord -Value 1 -Domain $domain -WhatIf

Note: The Example registry path is deliberately non-production. Replace it only with a vendor-documented policy path and value supported by the exact client editions in scope.

$domain = 'corp.example.com'
$pilotOu = 'OU=Pilot,OU=Workstations,DC=corp,DC=example,DC=com'
$gpo = Get-GPO -Name 'Pilot - Example Policy' -Domain $domain `
  -Server 'dc01.corp.example.com'
$scope = Get-GPInheritance -Target $pilotOu -Domain $domain `
  -Server 'dc01.corp.example.com'
$scope | Select-Object Path, GpoInheritanceBlocked, GpoLinks, InheritedGpoLinks
New-GPLink -Guid $gpo.Id -Target $pilotOu -LinkEnabled No -Enforced No `
  -Domain $domain -Server 'dc01.corp.example.com' -WhatIf
Set-GPLink -Guid $gpo.Id -Target $pilotOu -LinkEnabled Yes -Enforced No `
  -Domain $domain -Server 'dc01.corp.example.com' -WhatIf

$domain = 'corp.example.com'
$server = 'dc01.corp.example.com'
$gpo = Get-GPO -Name 'Pilot - Example Policy' -Domain $domain -Server $server
Get-GPPermission -Guid $gpo.Id -All -Domain $domain -Server $server |
  Select-Object Trustee, TrusteeType, Permission, Inherited
Set-GPPermission -Guid $gpo.Id -TargetName 'GG-GPO-Auditors' `
  -TargetType Group -PermissionLevel GpoRead -Domain $domain -Server $server -WhatIf

Note: Application filtering needs an explicit design review; GpoRead alone does not grant Apply Group Policy.

$computer = 'pc042.corp.example.com'
Test-Connection -ComputerName $computer -Count 2
Get-GPResultantSetOfPolicy -Computer $computer -ReportType Html `
  -Path 'C:\Reports\PC042-RSoP.html'
# On the target, an elevated local diagnostic can also write:
# gpresult.exe /h 'C:\Reports\gpresult.html' /f

$computer = 'pc042.corp.example.com'
Resolve-DnsName -Name $computer -Type A
Test-Connection -ComputerName $computer -Count 2

# No WhatIf is available. Run only after approval and user or workload coordination:
# Invoke-GPUpdate -Computer $computer -Target Computer `
#   -RandomDelayInMinutes 30 -AsJob

# After the refresh window, collect new evidence:
# Get-GPResultantSetOfPolicy -Computer $computer -ReportType Html `
#   -Path 'C:\Reports\PC042-RSoP-after.html'

Note: Do not add -Boot, -LogOff, or -Force casually. WhatIf on earlier GPO-editing cmdlets cannot preview this scheduled client action, AD/SYSVOL replication, extension behavior, application impact, or a rollback.