GPO Creation and Linking | Operator On The Wire

GPO creation and linking is stronger than editing an existing policy because we introduce a new policy and choose where it applies. This requires rights to create GPOs and rights to link a GPO to the target domain, OU, or site.

Create a GPO

New-GPO -Name "Workstation Baseline"

Link to workstation OU

New-GPLink -Name "Workstation Baseline" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local" -LinkEnabled Yes

Set a validation marker

Set-GPRegistryValue -Name "Workstation Baseline" `
  -Key "HKLM\Software\OOTW" `
  -ValueName "Baseline" `
  -Type String `
  -Value "Applied"

Force refresh

Invoke-GPUpdate -Computer ws01.ootw.local -Force -RandomDelayInMinutes 0

Check link

Get-GPInheritance -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local"

Check GPO folder

$Gpo = Get-GPO -Name "Workstation Baseline"
$Gpo.Id
Get-ChildItem "\\ootw.local\SYSVOL\ootw.local\Policies\{$($Gpo.Id.Guid.ToUpper())}" -Recurse

Remove link

Remove-GPLink -Name "Workstation Baseline" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local"

Remove GPO

Remove-GPO -Name "Workstation Baseline"

Notes

Creation leaves a new groupPolicyContainer object and a new SYSVOL policy folder.

Linking leaves a gPLink change on the target OU or domain.