The original purpose of this script was to backup and report on all Group Policy Objects (GPOs) in an Active Directory (AD) domain. That worked well for small domains, but recently I have worked with domains with hundreds of thousands of Organizational Units (OUs) and many thousands of GPOs. This script update makes working with extremely large AD domains easier.

The first update is the addition of an OrganizationUnit parameter. This allows you to specify a specific OU tree to process.

The second update is the addition of a GPOFilter parameter. This allows you to specify text in the GPO name to reduce the number of GPOs processed. For example, you could enter a GPOFIlter of “CTX” or “View” or “RAS” or “RDS” to process only the GPOs where that text appears anywhere in the GPO name.

I also added looking for illegal filename characters in the GPO name. The Get-GPOReport cmdlet uses the GPO display name as the Windows filename. While you can enter almost any character in a GPO name, Microsoft restricts the characters that are usable for creating a file in the Windows file system.

While a GPO with the name of “Policy for Adobe Reader/Pro” is valid, a Windows file named “Policy for Adobe Reader/Pro.html” is not allowed.

The Backup-GPO cmdlet uses the GPO’s GUID as the folder name to contain the backup files.

#Version 1.20 29-Mar-2019

• Received performance tuning help from Michael B. Smith for this update
• Add requirement for the ActiveDirectory module
• Add simple error checking to the backup and report creation
• Add two parameters: GPOFilter and OrganizationalUnit
• Adding testing for illegal filename characters ‘<>:”\/|?*’ in the GPO name  before creating the HTML and XML report files
• If both ADDomain and OrganizationalUnit are specified, set ADDomain to empty string
• Updated Function ProcessScriptEnd with new parameters
• Updated help text

You can always find the most current script by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster