Latest Free Tools

Free Tools 95

Darren Mar-Elia — Thu, 04 Jun 2009 04:10:00 GMT

GPO Version Powershell Cmdlets
Summary:

Powershell cmdlets to get GPO version information and also to "Touch" a GPO's version to force clients to think the GPO has changed.

*** UPDATED 10/19/09 to fix issue with whatif parameter incorrectly reporting new GPO version

The download includes a DLL and Help file. This is a 32-bit Powershell snap-in for version 1.0 of Powershell. Copy the two files to a folder, startup Powershell, change directories to where you copied the DLL, and then run installutil to install the snap-in as follows:

C:\windows\Microsoft.NET\Framework\v2.0.50727\installutil sdmgpoversion.dll

One registered, type the following to add the snap-in to your current Powershell console:

add-pssnapin SDMSoftware.Powershell.GPOVersion

The snap-in comes with 2 cmdlets:

Get-SDMGPOVersion: Retrieves AD & SYSVOL version information for one or more GPOs on a particular DC (similar to GPOTool.exe except for Powershell)

Invoke-SDMTouchGPO: Lets you increment a GPO's version number to force clients to think something there has been a GPO change.

You can type get-help and then the cmdlet name to get syntax for each cmdlet

Download Icon: icon-disk
Disclaimer: DISCLAIMER: Everything posted here is offered as is. By downloading it, you accept full responsibility for testing to ensure it does not cause any problems in your own environment. There is no warranty on any of the code or files on this page, so it's up

Free Tools 94

Darren Mar-Elia — Mon, 11 May 2009 04:34:00 GMT

GPO Reporter from Alan Kaplan
Summary:

This is an HTA written by Alan Kaplan, called GPO Reporter.

GPO Reporter is an HTA app that lets you select a set of GPOs in a domain and generate GPMC-based HTML settings reports for any number of them.

Disclaimer: DISCLAIMER: Everything posted here is offered as is. By downloading it, you accept full responsibility for testing to ensure it does not cause any problems in your own environment. There is no warranty on any of the code or files on this page, so it's up
[visit site]: http://www.akaplan.com/blog/?p=83

Free Tools 93

Darren Mar-Elia — Wed, 05 Nov 2008 18:18:00 GMT

WMI Filter Validation Utility
Summary:

Updated!

Validates GPO WMI Filters against live systems to make sure that the filter you write will pass or fail as expected.

This utility was built to help validate whether or not a particular WMI filter applies to a particular computer (or user logged into that computer). The tool returns a list of WMI filters defined for a given domain, the GPOS they are linked to and the WMI query that is contained within them. If you right-click on a particular filter, you can run a wizard that lets you connect to a target computer and run the query against the computer to determine if the filter will evaluate to true or false on that particular computer (or user logged into the computer). If the filter evaluates to true, that means that the GPO that is linked by the filter will be applied. If the filter evaluates to false, then the GPO will not be applied. This is a quick and dirty way, without having to run an RSOP model, to determine whether a filter applies or not. Note that the tool will work against Win2K machines even though Win2K does not understand WMI filters.

The tool also allows you to print out the list of WMI filters defined on the domain. The screen shot gives a flavor of the tool.

Requirements: For the 1.0.* version of WMIFTest, you need the .Net Framework 2.0 installed on the machine where you run this utility from.

Release History

Version 1.0.3 released on Nov 8, 2008: Adds support for WMI filters that contain multiple WQL queries.

Version 1.0.2 (current) released on July-17-07: Fixes an issue where the tool would throw an error if a WMI filter had a blank description and fixes some issues with the host ping validation.

Free Tools 91

Darren Mar-Elia — Mon, 09 Jun 2008 20:34:00 GMT

PowerShell Cmdlets for Group Policy
Summary:

NEW version. 25 PowerShell cmdlets for GPMC (in Server 2008, Vista, SP1 version)--builds on what we have here with the following:

Add-SDMgplink: Links a GPO to a particular AD container (site,domain or OU)
Get-SDMgplink: Retrieves a list of linked GPOs from a particular AD container
Remove-SDMgplink: Removes a GPO link from a given AD container
Export-SDMgpo: Backs up a GPO to a given folder path
Get-SDMgpo: Retrieves information about one or all GPOs in a domain
New-SDMgpo: Creates a new GPO in a domain
Remove-SDMgpo: Deletes an existing GPO from a domain
Restore-SDMgpo: Restores a GPO from backup
Get-SDMgpoBackups: Retrieves the list of all backed-up GPOs (or a given GPO) from a given folder path
Add-SDMgpoSecurity: Adds a GP permission (ACE) for a given group to a given GPO
Get-SDMgpoSecurity: Retrieves a list of GP permissions from a given GPO
Remove-SDMgpoSecurity: Removes a particular permission for a given group from a given GPO.

Add-WMIFilterLink: Links an existing WMI filter to a GPO
Copy-SDMStarterGPO: Copies an existing Starter GPO to a new Starter GPO (Server 2008 and Vista, Sp1 only)
Get-SDMStarterGPO: Retrieves a reference to and information on a named Starter GPO (Server 2008 and Vista, Sp1 only)

Get-SDMWMIFilter: Retrieves a reference to and information on one or all WMI Filters in a domain
New-SDMStarterGPO: Creates a new Starter GPO (Server 2008 and Vista, Sp1 only)
Out-SDMGPSettingsReport: Creates an xML or HTML GPO Settings report
Out-SDMRSOPLoggingReport: Creates and XML or HTML Group Policy Results report
Remove-SDMStarterGPO: Deletes a Starter GPO (Server 2008 and Vista, Sp1 only)
Remove-SDMWMIFilterLink: Removes any WMI Filter linked to a particular GPO

You can download these at the SDM Software Site

To get help on the syntax for any cmdlet, just type get-help <cmdlet name> at a Powershell prompt.

If you have any feedback or questions on these cmdlet, just email us!

[visit site]: http://sdmsoftware.com/freeware.php

Free Tools 89

Darren Mar-Elia — Mon, 09 Jun 2008 20:30:00 GMT

Local GPO Disable Script
Summary:

This .vbs script will disable the local GPO on a given pre-Vista system (Vista comes with an Admin. Template policy to do this). On Win2K, XP and 2003, there is no centralized way to disable the Local GPO.

You can use this script in a Group Policy Startup Script to accomplish the task. Note that because this script edits a protected file on the local system, a normal user account will not be able to successfully run this, so you won't be able to deliver it as a logon script. That is why I recommend running it as a startup script.

Download Icon: icon-disk

Free Tools 88

Matty Holland — Mon, 09 Jun 2008 20:28:00 GMT

Vista Central Store Creator Utility
Summary:

This utility simplifies the creation of the "Central Store" for storing Vista ADMX/ADML templates. Its a very simple utility.

Updated version 1.1 released!

In the domain name dialog, you enter the DN of the domain where you want to create the central store. This gets autopopulated if you run the tool from a computer already in a domain. Next, you press the "Check Central Store" button and the tool checks to see if the Central Store exists already. Ff not, you are prompted to create it. By default, the tool only looks in %windir%\policydefinitions on the machine where its running, as uses the contents found there to populate the central store. When you say 'yes' to creating the central store, all files found locally (including ADML files) are copied up to the newly created Central Store folder, which is by default, in \\<domain>\sysvol\<domain>\policies\policydefinitions. That's all there is to it!

Requirements: You need the .Net Framework 2.0 installed on the machine where you run this utility from. The utility is meant to be run from Vista.

Version History:

Version 1.1 (current): This is a new release that fixes a bug where the tool fails to find SYSVOL shares that have been relocated to a different volume than the default one.

Version 1.0 (original): This is the first release and can be found in the archives.

Download Icon: icon-disk

Free Tools 87

Matty Holland — Mon, 09 Jun 2008 20:24:00 GMT

Registry.Pol Viewer Utility
Summary:

This utility provides read-only access into the registry.pol file (or any other .pol file). Registry.pol is the file that GP uses to store registry-based policy settings made by Administrative Template, Software Restriction Policy or Disk Quota policy.

For example, when you add an administrative template setting within a GPO, that setting is stored in the registry.pol file within the SYSVOL portion of the GPO. Registry.pol files are either per-machine or per-user, depending upon which side of the GPO you're editing. For this reason, a given GPO might have two registry.pol files. The format of the registry.pol file is described on MSDN at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/policy/policy/registry_policy_file_format.asp. It is a Unicode-based file format where each registry entry is stored in well-defined and delimited fields. This utility simply reads each registry value that has been defined within the .pol file and displays the registry key, value, value type (e.g. REG_DWORD, REG_SZ) and data that is stored for that value. The utility can be useful if you're trying to determine whether a given policy setting is "stuck" within a registry.pol for which the accompanying ADM template is no longer available. Note that this utility does not allow you to edit the file. The utility is easy to use. Simple start the polviewer.exe executable and enter a path (it can be a drive letter or UNC path) to the registry.pol file you wish to examine. Note that the tool will detect if you have selected a file to read that is not a valid registry.pol file. Once you've entered the path to the file, press the Submit button to retrieve the contents of the file, as shown below.

Requirements: You need the .Net Framework 1.1 installed on the machine where you run this utility from.

Version 1.1 (current): A few minor changes in this release, including a new Browse button. Also the submit button is now the default button and does not require you to explicitly click on it to open the file. I also added the ability to open a .pol file from the Explorer shell that automatically populates the input box in PolViewer. So, if you right-click a .pol file in Explorer and select "Open With" Polviewer, the full file name and path will be auto-populated into the app.

Older versions of this tool can be found in the Tool Archive.

Download Icon: icon-disk

Free Tools 86

Matty Holland — Mon, 09 Jun 2008 20:23:00 GMT

AD,DNS, FRS, DFS-R,Forwarded Events, Hardware Events Event Log Settings ADM Template
Summary:

This is a custom .ADM file that exposes the log size and retention method options for the "non-standard" event logs found on Active Directory Domain Controllers.

Updated 28/12/06 by Jorge de Almeida Pinto [MVP-DS] (http://blogs.dirteam.com/blogs/jorge/default.aspx) to add configuration for DFS Replication, Forwarded Events and Hardware Events logs found in Windows 2003 R2.

This is a custom .ADM file that exposes the log size and retention method options for the "non-standard" event logs found on Active Directory Domain Controllers. Specifically, with this policy you can set maximum size and retention method for the AD, DNS and FRS event logs. When loaded into a GPO, these ADM options appear as preferences under Computer Configuration\Administrative Templates\System\Event Log (see Figure below). NOTE: In order to see these policies in the GPO editor, you have to set the Filter that says you want to view "unmanaged" policies.

Free Tools 85

Matty Holland — Mon, 09 Jun 2008 20:20:00 GMT

GPO Logging Custom ADMX (for Windows Vista)
Summary:

GPLogging.ADMX : This is a port of gpolog.adm to the new Vista ADMX/ADML file format. Included in the download is the ADMX file for enabling the logs that are still valid in Vista, as well as the language-independent strings file (.ADML) for the English language.

See also the ADM version of this in this Free Tools section.

GPLogging.ADMX

UPDATED on 12/14/06 to include new custom ADMX for enabling logging in Vista RTM (updated version number in ADMX so they would load correctly in Vista RTM)

Look for other languages here as soon as I can get them ported. The Figure below shows what the new ADMX looks like in the Vista GP Editor

Remember, these are still preferences, so you have to set the Filtering within the GP Editor to allow "unmanaged" settings to be shown. To download the new ADMX/ADML files, click the download link below. To install this new template, copy the ADMX file to c:\windows\policydefinitions on the Vista machine where you edit Group Policy, and copy the ADML file to the en-us folder under the policydefinitions folder. If you're using the central, copy these two files to the central store within the same folders.

Free Tools 84

Matty Holland — Mon, 09 Jun 2008 20:17:00 GMT

GPO Logging Custom ADM
Summary:

Check out the related ADMX version of this as well!

This is a custom .ADM file that I created that exposes all the GPO-related logging that I could find documented, including verbose Application Event Log stuff, Software Installation, Folder Redirection, Security, GPMC and even logging of the GPO Editor client itself. NOTE: In order to see these policies in the GPO editor, you have to set the Filter that says you want to view "unmanaged" policies. These policies then appear with a red icon next to them, as shown here:

Download Icon: icon-disk

Free Tools 83

Matty Holland — Mon, 09 Jun 2008 20:15:00 GMT

Command-line Remote GPO Refresh
Summary:

NEW!!!! PowerShell version of this utility available at SDM Software Freeware Page

This is a command line utility to remotely refresh Group Policy on Win2K, XP or Server 2003.

NEW!!!! PowerShell version of this utility available at SDM Software Freeware Page

The utility auto-detects the target OS version and applies the appropriate options. NOTE: You need the .Net Framework 1.1 installed on the machine where you run this utility from. The following screen shot gives you an idea of the command-line options available, which mirror what are available in the native tools that come with Win2K, XP and 2003. Please let me know if you find any bugs. I tested on all 3 OS' but your mileage may vary.

Also, there's a good article on refreshing Group Policy remotely, along with a tool that lets you use rgprefresh against multiple computers, written by Jakob Heidelberg, here

Release History

Version 1.6 (current): Adds a new /n parameter that lets you specify that you don't want to trigger a reboot or logoff (added in 1.5) when using the /force /sync or /boot parameters and gpupdate would normally require a reboot or logoff to force a synchronous processing event. Also adds some additional debugging information in the event that the refresh fails.

Download: rgprefresh16.zip -- 4.8KB

Version 1.5: In this version, the tool will automatically logoff or reboot a target XP or Server 2003 system if required by Group Policy. This is different than 1.0, which did not perform this reboot or logoff task as it should have. This version also fixes some other bugs, including a "parameter is incorrect" error when connecting to a remote system without specifying credentials.

Download: rgprefresh15.zip -- 4.7KB

Version 1.0 (original): This is the first version of the tool and provided for remote refresh of Group Policy on XP, Server 2003 and Windows 2000 systems.

Download: rgprefresh.zip -- 4.4KB

Screen Shot of Version 1.6

Free Tools 82

Matty Holland — Mon, 09 Jun 2008 20:10:00 GMT

Group Policy Software Installation Viewer Utility
Summary:

GPSI "GYPSY" VIEWER UTILITY

Within native tools, there is no way to quickly get an at-a-glance view of all applications deployed via Group Policy Software Installation (GPSI) policy across a domain. This simple GUI utility lets you quickly view all applications that have been published or assigned (or removed) using Group Policy, within a domain. With the newest version, you can also print the list of applications to a report or save it as a .csv file.

The figure below shows what this tool looks like:

[larger image]

The GPSIViewer utility will automatically try to resolve the AD domain that the workstation running the tool belongs to. If it can not or you wish to connect to a different domain, then you will be able to enter the domain name manually, using either the LDAP distinguished name, as shown above, or the DNS name (e.g. mycompany.com). Note that, when you remove a deployed package from a GPO, that package definition is not actually removed from AD. This is because removed packages may need to be de-installed from target machines and thus the package is marked for removal. Using this mechanism, the next time the user or computer that had installed the application processes the GPO, it knows to remove the package. I have marked removed packages with Red to indicate their state.

Requirements: For the 1.6 version of "GYPSY", you need the .Net Framework 2.0 installed on the machine where you run this utility from. The 1.0 version requires at least .Net 1.1.

Release History

Version 1.6 (current): Version 1.6 adds the Date Created and Date Last Modified columns to the display and to reporting.

Download: from above -- 10.6KB

Version 1.5: The 1.5 version adds a few new features. For example, I added a column that lists any transforms applied to the package. I also add "tool tips" to each row, which lets you hover your mouse over a column that contains large amounts of text, and see what the full contents of that text is without having to expand the column. I also added the ability to print the list of apps to a printer. Finally, I created a save to .csv option that lets you output the list to a .csv file for easy import into Excel.

Download: GPSI "GYPSY" Viewer 1.5 -- 10.1KB

Version 1.0 (original): This is the original version of the tool that allows you to view GPSI deployed apps.

Download: SIViewer 1.0 -- 7.3KB

Free Tools 81

Matty Holland — Mon, 09 Jun 2008 20:09:00 GMT

GPO Editor Clipboard Utility
Summary:

UPDATED!!!! This is a handy little MMC namespace extension DLL written for me by one of the smartest guys I know--Chuck McDonald. Chuck can do pretty much anything with code. One thing I've always been frustrated about in the GPO Editor tool is the inability to copy the path that you're currently selected on to the clipboard.

UPDATED!!!! Well, Chuck has come through again and now this utility will copy the entire policy path into the clipboard, from the actual policy item on up! Just as before, select the policy item in the right-hand result pane then hold down CTRL-SHIFT and right mouse click. The whole policy path will be copy to the clipboard. Cool!

This is a handy little MMC namespace extension DLL written for me by one of the smartest guys I know--Chuck McDonald. Chuck can do pretty much anything with code. One thing I've always been frustrated about in the GPO Editor tool is the inability to copy the path that you're currently selected on to the clipboard. This is handy for documenting GPO changes and describing to others where to find a particular policy. If you download this ZIP file, copy the DLL to somewhere on your machine and register it using regsvr32 gpoguycopynodepath.dll. Now, you can't use it with pre-created GPO .msc files, like those found in the Administrative Tools folder or gpedit.msc, but if you create your own MSC, it works just great. The way it works is, while highlighting a particular path in the left-hand scope pane of a GPO editor tool, press the CTRL and SHIFT keys, then right mouse-click on the node you're selected on. The full path within the GPO will be copied to the clipboard. For example, if I've highlighted Computer Configuration|Windows Settings|Security Settings|Local Policies|User Rights Assignment, then that full path will be copied to the clipboard by pressing CTRL-SHIFT-Right Mouse. Simple! Currently the tool doesn't capture actual policy items in the right-hand results pane, but that was my next request to Chuck so stay tuned.

Free Tools 80

Matty Holland — Mon, 09 Jun 2008 20:05:00 GMT

GP Time
Summary:

This handy little utility is designed to quickly and succintly report the last time computer and user Group Policy was run on a local or remote system. If there has been more than one user logged onto the system, the tool will report GP processing times for all users found.

(This tool works for XP and Server 2003 only--Win2K not supported)

The tool provides the start and stop times for the last processing cycle as well as total elapsed time, which can be handy to see if a set of GPOs are taking too long to process. The output looks like that shown in the Figure below:

NOTE: You need the .Net Framework 1.1 installed on the machine where you run this utility from.

The Figure above show the tool running against the local machine. If you want to check a remote machine, simply supply the machine name after the command like this:

gptime workstation1

Download Icon: 1
Disclaimer: DISCLAIMER: Everything posted here is offered as is. By downloading it, you accept full responsibility for testing to ensure it does not cause any problems in your own environment. There is no warranty on any of the code or files on this page, so it's up

Free Tools 78

Matty Holland — Mon, 09 Jun 2008 20:04:00 GMT

SysProSoft GP-related Utilities
Summary:

Alan Cuthbertson over at SysProSoft down in Oz has some cool utilities that I wanted to point out. The latest is a neat parser for Userenv.log files, called Policy Reporter. He's also got a nifty ADM Template Editor to help simplify the process of creating ADM templates. Finally, He's got some GP Management software, called PolMan, with some nifty reporting and troubleshooting features.

[visit site]: http://www.sysprosoft.com/

Free Tools 79

Matty Holland — Mon, 09 Jun 2008 20:04:00 GMT

SpecOps GPUpdate
Summary:

The SpecOps guys in Sweden have released a very cool free add-on to AD Users and Computers that let's you graphically and remotely refresh Group Policy on remote nodes as a right-click option in the UI. Its also let's you do a refresh across multiple machines and provides a cool graphical progress bar. Not bad for a free tool!

[visit site]: http://www.specopssoft.com/products/specopsgpupdate/default.asp

Free Tools 77

Matty Holland — Mon, 09 Jun 2008 20:03:00 GMT

RegtoADM
Summary:

This is part of a set of utilities called NUTS. And can be downloaded at http://yizhar.mvps.org