So, have you ever been tasked with moving file shares or printer shares to a new server? How enjoyable is it combing through Group Policy to find where the old server name is used? Yeah, its not.
Powershell to the Rescue! The below script will look for any text within all the group policies and let you know which ones the text is found in. A server name is the most obvious thing to look for, but it could be a user name or a share name, etc.
# Get the string to search for
$searchString = Read-Host -Prompt "Enter the string to search for in GPOs"
# Set the domain to search for GPOs
$DomainName = $env:USERDNSDOMAIN
# Check if Group Policy module is available, import if not
if (-not (Get-Module -Name GroupPolicy -ListAvailable)) {
Import-Module GroupPolicy -ErrorAction Stop
}
# Find all GPOs in the current domain
Write-Host "Finding all the GPOs in $DomainName"
try {
$allGposInDomain = Get-GPO -All -Domain $DomainName -ErrorAction Stop
} catch {
Write-Host "Error: Failed to retrieve GPOs. $_" -ForegroundColor Red
exit
}
$matchedGPOs = @()
# Search through each GPO's XML for the specified string
Write-Host "Starting search..."
foreach ($gpo in $allGposInDomain) {
try {
$report = Get-GPOReport -Guid $gpo.Id -ReportType Xml -ErrorAction Stop
} catch {
Write-Host "Error: Failed to retrieve report for $($gpo.DisplayName). $_" -ForegroundColor Yellow
continue
}
if ($report -match $searchString) {
Write-Host "Match found in: $($gpo.DisplayName)" -ForegroundColor Green
$matchedGPOs += $gpo.DisplayName
} else {
Write-Host "No match in: $($gpo.DisplayName)"
}
}
# Display results
Write-Host "`nResults:`n**************" -ForegroundColor Yellow
foreach ($match in $matchedGPOs) {
Write-Host "Match found in: $($match)" -ForegroundColor Green
}
Sharing out company information is a very important thing to do right – who gets to see what and what can they do with it? That is why it is best to have a plan in place before beginning.
Plan to have the shares in one folder, on a data drive (not OS), preferably on a dedicated File Server (not a NAS, please). Name the folders something recognizable.
Company is the general share that everyone can access.
Executive is the share for Executives
Accounting is the share for the accounting department – payroll, billing, etc.
Home is a folder for each user’s Home Drive (As set up in Active Directory)
Departments is a top folder with department folders inside, each department folder shared out to it’s department security group.
Ah, yes – Security Groups. You will always want to assign permissions using security groups. It is a lot easier to manage adding users to security groups than going around digging through folders for which ones they need access to. If they need access, there should be a security group for that!
Now, how to map the folders? Group Policy. Put one group policy for each Security Group and which folders they need mapped.
Another very awesome tool for doing group policy is Item-Level Targeting. With this, you can use one policy with multiple items that go to different groups – such as printers, drive maps, etc.
On the Common Tab, Check the Item-level targeting box and click the targeting button…
Item Level Targeting
There are a LOT of options – even though I normally use only the Security Group option – you can get very specific.
Endless Options to target…The most used (by me) Targeting…
So, if you are deploying dozens of printers or drive mappings – or software – use Item-Level targeting to control who or which pc gets what. It saves clutter in Group Policy management.
In the last post, I covered setting up a new domain controller and some things to help keep your domain healthy, well organized and your IT provider happy.
In this followup, I will keep going. Now that we have a Domain Controller, a Domain and DNS, we should look at Group Policy.
Group Policy Walk-Thru
One of the reasons that we chose to create OUs instead of Containers in the last post/video is that group policy can be applied to OUs, but not Containers.
In going over Group Policy, I’d like to start with User folders. In a corporate environment, losing a file can be a very bad thing. For the most part, servers are backed up, but workstations are not. So, how to protect the files of users? Server Shared folders are one option, but I’ll cover a couple others in this post – Folder Redirection and Home Folders. These let your users have more control over their files, as other users can not normally access either one.
It is a good idea to make a dedicated drive for Data files, separate from the OS drive.
For Home folders, create a folder on the Data drive named something like “HomeFolders.”
Open properties of the folder, security, advanced and disable inheritance.
Remove the Users permissions – give Authenticated users “This Folder Only” permissions to: “List folder / read data“ “Read attributes“ “Read extended attributes“ “Create folders / append data“ and “Read permissions“
The user “Creator Owner” should have “Subfolders and Files only” full control.
On the Sharing tab, use advanced and share the folder as “Home$” to make it a hidden share. Give Everyone read and Authenticated Users full control of the share.
In Active Directory Users and Computers, on the Profile tab, in the Home Folder section, choose a drive letter and put a path with a folder name that matches the user’s logon name.
Clicking Apply creates the folder. If you have a lot of users and don’t want to edit every user to add the home folder, you can use powershell – but you will need to use powershell to give them permissions to the folder as well. Below is a powershell script to create the folders for existing users, give the users permissions and set the home folder for all users in active directory.
Import-Module ActiveDirectory
#Script for updating folder permissions to give the user full access to their home folder
# as long as its named the same as their username - so, jdoe will have full access to the jdoe folder.
# - with This "Folder, Subfolders and Files" level.
#
# --- change the domain name
$domain = "kearan"
$hdpath = "E:\KearanCo\HomeFolders"
# --- Make Home Directories
$users=get-aduser -filter *
Foreach($user in $users){
$usern=$user.samaccountname
$nhd = $hdpath + "\" + $($usern)
New-Item -ItemType Directory -Path $nhd
}
# ---- change the Folder Path
$folders = Get-ChildItem -Path $hdpath | Where-Object -FilterScript {
$_.PSIsContainer -eq $true
}
# --- Set the folder permissions
foreach ($folder in $folders)
{
$path = $folder.fullname
$ACL = Get-Acl -Path $path
$user = $folder.name
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$domain\$user","FullControl",”ContainerInherit, ObjectInherit”,"None",”Allow”)
$AccessRule1 = New-Object System.Security.AccessControl.FileSystemAccessRule("$domain\Domain Admins","FullControl",”ContainerInherit, ObjectInherit”,"None",”Allow”)
$Account = New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList "$domain\$user"
$acl.SetOwner($Account)
$acl.SetAccessRule($AccessRule)
$acl.SetAccessRule($AccessRule1)
$acl | Set-Acl $path
}
# --- Set users Home Directory in AD ---
# --- change "FileServer" to the actual file server name
# --- and Home$ to the actual share name. And H to your share letter.
$users=get-aduser -filter *
Foreach($user in $users){
$usern=$user.samaccountname
$HomeDir="\\FileServer\Home$\$($usern)" -f $usern
Set-ADUser $user -HomeDirectory $HomeDir -HomeDrive H:
}
You can use each section of the above script as a stand-alone script in order to do one at a time. Use the below code to change an existing home drive to a new server.
For Folder Redirection, create an AD group for all those you want to have redirected folders. Unless you are comfortable having all the users in an OU having the folder redirection, of course. To have more control over what accounts get the folder redirection, use the AD group method.
Create a folder, like the Home Folder above, with the same permissions. Now, go into Group Policy Management and create a new Group Policy.
Edit the group policy and go to User Configuration –> Policies –> Windows Settings –> Folder Redirection
Choose the items to redirect (See the video) and set the scope of the policy to Domain Computers (or whichever computer group you want, such as RDS Servers) and the Group you want to apply it to, ie “Folder Redirection Group.” Apply the policy to the domain, or the target OU.
See the video for more on Group Policy and Troubleshooting.
