Cloud

Create a shortcut to modify a Group Policy Object

For test environments, you can save time by making a shortcut to modify a Group Policy Object. IT guru Rick Vanover walks you through this process.

If you have ever had to go through a number of configurations to get a new set of Group Policy Objects (GPOs) working correctly, one of the biggest inconveniences is frequently going in and out of the Group Policy Editor to manipulate the policies in question. There's an easy way to make this process a shortcut.

The first thing to understand is the globally unique identifier (GUID) that is associated with every Active Directory object. A GUID is assigned to every GPO, and determining this string is the first step. The GUID is visible in the Details tab of the GPO in question (Figure A). Figure A

Click the image to enlarge.

You can copy this field by right-clicking it; you can then put the field into a command string to edit the GPO. The command string launches the Group Policy Editor directly to that object in the directory. The text below is an example command string to edit the GPO shown in Figure A in my private lab:

gpedit.msc /gpobject:"LDAP://CN={0523F1BD-B9F1-469A-87B8-D28E2345BADD},CN=Policies,CN=System,DC=rwvdev,DC=intra"

It's a little tricky to determine where to put the GUID, so I've taken this text example and highlighted where it goes and the domain configuration. Figure B shows where these two pieces of information go in the command string: Figure B

Click the image to enlarge.

The green section is where the GUID is inserted, and the yellow section is where the domain information goes (in my case, the RWVDEV.INTRA domain is enumerated).

Then you can save the string as a shortcut or run it interactively to go directly into the editor for the GPO in question. The changes are made live and saved when closed as long as the permissions are in place. This can make frequent changes much easier for testing new configurations.

About

Rick Vanover is a software strategy specialist for Veeam Software, based in Columbus, Ohio. Rick has years of IT experience and focuses on virtualization, Windows-based server administration, and system hardware.

3 comments
Jacques.Gordon
Jacques.Gordon

I'll give that a shot, what I usually do is just create a custom MMC with Group policy editors inside for my different GPOs and save it to the desktop.

tim.3.mitchell
tim.3.mitchell

There's an easier way than this. At least there is with Server 2008R2 - I can't vouch for whether this is available in the previous versions: Run mmc and add the Group Policy Management Editor snap-in. You can then choose which group policy to modify through the GUI. Then, just save this msc as you would any other msc, and you have your ready-made shortcut to edit that GPO.

jakesty
jakesty

Thank Rick. I'm still a noob at group policies, so I don't have a need for this yet. But I'm always setting up shortcuts for everything and this is one of those obscure ones I'm sure you'd never find out there. Jake

Editor's Picks