Backup Active Directory Group Policies with PowerShell

Tue, 22 Apr 2014 08:02:13 +0000

Based on my last Active Directory backup script I’ve developed a similar script to backup all group policies.

What it does:

Create a daily full snapshot of all group policy objects
Keep a daily, weekly and monthly snapshot
Notify me if something failed (requires PowerShell PowerUp)

<#
$Metadata = @{
    Title = "Backup Active Directory Group Policies"
    Filename = "Backup-ADGroupPolicies.ps1"
    Description = ""
    Tags = "backup, active, directory, group, object, policy"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2014-04-22"
    LastEditDate = "2014-04-22
    Url = ""
    Version = "0.0.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/ch/ or 
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

try{

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#
    
    Import-Module ActiveDirectory
    Import-Module GroupPolicy
    
    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#

    $Path = "C:\backup\GroupPolicy"

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    # create backup file name
    $Filename = "GroupPolicyFull" + "#" + $((Get-Date -Format s) -replace ":","-") + ".bak"
    $Filepath = Join-Path $Path $Filename

    # backup active directory
    Get-GPO -All | ForEach-Object{
    
        $GPOFilepath = Join-Path $Filepath $_.DisplayName    
        New-Item -Path $GPOFilepath -ItemType Directory
        Backup-GPO -Guid $_.ID -Path $GPOFilepath    
    }
    
    # get dates for backup retention exclusion
    $Today = Get-Date -Format d
    $FirstDateOfWeek = Get-Date (Get-Date).AddDays(-[int](Get-Date).Dayofweek) -Format d
    $FirstDateOfMonth = Get-Date -Day 1 -Format d

    # delete all backups except for today, first day of week and first day of month
    Get-ChildItem $Path | select *,@{L="CreationTimeDate";E={Get-Date $_.CreationTime -Format d}} | Group-Object CreationTimeDate | %{
        
        # only one backup per day
        if($_.Count -gt 1){
            
            $_.Group | Sort-Object CreationTime -Descending | Select-Object -Skip 1     
        }
                
        # keep only required backups
        $_.Group | Where-Object{$_.CreationTimeDate -ne $Today -and $_.CreationTimeDate -ne $FirstDateOfWeek -and $_.CreationTimeDate -ne $FirstDateOfMonth}
            
    } | Remove-Item -Recurse -Force
    
}catch{

    Write-PPErrorEventLog -Source "Backup ActiveDirectory Group Policies" -ClearErrorVariable
}

Latest version of this script: https://gist.github.com/11167763

Project: Setup Windows 7 Kiosk

Fri, 04 Oct 2013 16:01:56 +0000

The goal of this project is a simple Windows 7 Kiosk installation with nothing else as the newest version of internet explorer installed. A user should not be allowed to do something than can malfunction the system or even elevating the user privileges. I want to show you in this post which GroupPolicies I’ve used and what configurations I made to set up this type of installation.

First I want to commit my principles for working with ActiveDirectory and Group Policies:

The logged in user can…

The setup of the windows workstation is very simple:

The Group Policy Management Console is equipped with newest Windows 7 AMDX templates.

The following section shows the policies I’ve used to restrict the access to the computer and it’s programs.

Desktop background

Add a desktop wallpaper.

Remove Desktop Icons

Remove the default desktop icons.

Remove System Buttons

Remove the start system buttons and the options showed after click Ctrl + Alt + Delete.

Restricted Start Menu

Remove the all items in the windows start menu.

Restricted Taskbar

Denie any possiblity to customize the windows taskbar.

SharePoint Icon

Adds a simple icon to the desktop.

Delete Cache

Delete the browser cache on exit.

Disable Save Passwords

Internet explorer is not allowed to prompt for saving password information.

Hide Menus

Hide internet explorer menus.

Policy on Janik von Rotz

Backup Active Directory Group Policies with PowerShell

Project: Setup Windows 7 Kiosk