Get-GPInheritance

Module:: GroupPolicy

Gets Group Policy inheritance information for a specified ___domain or OU.

Syntax

Get-GPInheritance
   [-Target] <String>
   [-Domain <String>]
   [-Server <String>]
   [<CommonParameters>]

Description

The Get-GPInheritance cmdlet gets information about Group Policy inheritance for a specified ___domain or organizational unit (OU).

This information includes the following:

A list of GPOs that are linked directly to the ___location (the GpoLinks property).
A list of GPOs that are applied to the ___location when Group Policy is processed on a client (the InheritedGpoLinks property).
Whether inheritance is blocked for the ___location (the GpoInheritanceBlocked property).

The InheritedGpoLinks property contains a list of the GPOs are applied to the OU or ___domain when Group Policy is processed on a client. The GPOs are listed according to the order of precedence with which they are applied. This list includes (in the following order):

Inherited GPOs that are linked, enabled, and enforced at higher levels of the Group Policy hierarchy (for example, a site).
GPOs that are linked and enabled directly at the specified ___location.
If inheritance is not blocked for the specified ___location, inherited GPOs that are linked and enabled -- but not enforced -- at higher levels of the Group Policy hierarchy.

Examples

Example 1: Get Group Policy inheritance information for a specific OU

Get-GPInheritance -Target 'ou=MyOU,dc=contoso,dc=com'

ContainerName         : myou
ContainerType         : OU
Path                  : ou=myou,dc=contoso,dc=com
GpoInheritanceBlocked : No
GpoLinks              : {TestGPO-0, TestGPO-1, TestGPO-2, TestGPO-3...}
InheritedGpoLinks     : {TestGPO-2, TestGPO-3, Default Domain Policy}

This command gets Group Policy inheritance information for the OU named MyOU in the contoso.com ___domain.

The GpoLinks property contains a list of all the GPOs that are linked directly to the GPO, whether their links are enabled or not.

The InheritedGpoLinks property contains a list of all the GPOs that are applied when Group Policy is processed on the client. TestGPO-2 and TestGPO-3 appear in this list because their links are enabled.

The Default Domain Policy GPO is inherited from the contoso.com ___domain. If inheritance is blocked, it does not appear in the InheritedGpoLinks property unless its link is enforced at the ___domain. If its link is enforced, it appears first in the list.

Example 2: Get Group Policy inheritance for a specific ___domain

Get-GPInheritance -Target "dc=contoso,dc=com" -Domain "contoso.com" -Server "DomainController1"

Name                  : contoso.com
ContainerType         : Domain
Path                  : dc=contoso,dc=com
GpoInheritanceBlocked : No
GpoLinks              : {Default Domain Policy}
InheritedGpoLinks     : {Default Domain Policy}

This command gets Group Policy inheritance information for the contoso.com ___domain. The ___domain controller with the host name DomainController1 is contacted to complete the operation.

The ___domain does not have to be explicitly specified using the Domain parameter in this example. If the ___domain of the user that is running the session (or, for startup and shutdown scripts, the computer) is the same as the target ___domain, or a trust exists between it and the target ___domain, you do not have to specify the Domain parameter.

Example 3: Get GPOs that are linked to a specific organizational unit by evaluating the SOM object

(Get-GPInheritance -Target "ou=myou,dc=contoso,dc=com").GpoLinks |
    Foreach-Object { Get-GPO -Name ($_.DisplayName) }

DisplayName      : TestGPO-3
DomainName       : contoso.com
Owner            : CONTOSO\Domain Admins
Id               : d02126d4-82e8-4e87-b4a0-2d44b6891411
GpoStatus        : AllSettingsEnabled
Description      :
CreationTime     : 2/27/2009 2:59:51 PM
ModificationTime : 2/27/2009 4:00:44 PM
UserVersion      : AD Version: 13, SysVol Version: 13
ComputerVersion  : AD Version: 0, SysVol Version: 0
WmiFilter        :

DisplayName      : TestGPO-2
DomainName       : contoso.com
Owner            : CONTOSO\Domain Admins
Id               : 375865b2-3b5f-480f-8f56-2a994ea6e725
GpoStatus        : AllSettingsEnabled
Description      :
CreationTime     : 2/26/2009 11:28:08 PM
ModificationTime : 3/1/2009 11:07:30 AM
UserVersion      : AD Version: 0, SysVol Version: 0
ComputerVersion  : AD Version: 1, SysVol Version: 1
WmiFilter        :

This command evaluates the SOM object Microsoft.GroupPolicy.SOM returned by Get-GPInheritance and returns the GPOs that are linked to the MyOU organizational unit. You can use this command to set properties of the GPOs by piping its output into other cmdlets. For instance, you can pipe the output to the Set-GPPermissions cmdlet to delegate permissions to administrators of the OU for each of the GPOs linked to the OU.

The GpoLinks property of the SOM object contains a list of all the GPO links for the OU. Each object in this list is of type Microsoft.GroupPolicy.GpoLink.

The collection is piped into a Foreach-Object command, which retrieves each GPO by using the DisplayName property of the GpoLink object.

Parameters

-Domain

Specifies the ___domain for this cmdlet. You must specify the fully qualified ___domain name (FQDN) of the ___domain.

For the Get-GPInheritance cmdlet, this is typically the ___domain of the container (___domain or OU) for which you want to retrieve inheritance information. If the specified ___domain is different than the ___domain of the container, a trust must exist between the two domains.

If you do not specify the Domain parameter, the ___domain of the user that is running the current session is used. If the cmdlet is being run from a computer startup or shutdown script, the ___domain of the computer is used. For more information, see the Notes section in the full Help.

If you specify a ___domain that is different from the ___domain of the user that is running the current session (or, for a startup or shutdown script, the computer), a trust must exist between that ___domain and the ___domain of the user or the computer.

You can also refer to the Domain parameter by its built-in alias, DomainName. For more information, see about_Aliases.

Type:	String
Aliases:	DomainName
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-Server

Specifies the name of the ___domain controller that this cmdlet contacts to complete the operation. You can specify either the fully qualified ___domain name (FQDN) or the host name.

If you do not specify the name by using the Server parameter, the primary ___domain controller (PDC) emulator is contacted.

You can also refer to the Server parameter by its built-in alias, DC.

Type:	String
Aliases:	DC
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Target

Specifies the ___domain or the OU for which to retrieve the Group Policy inheritance information by its Lightweight Directory Access Protocol (LDAP) distinguished name. For instance, the MyOU organizational unit in the contoso.com ___domain is specified as ou=MyOU,dc=contoso,dc=com.

You can also refer to the Target parameter by its built-in alias, Path.

Type:	String
Aliases:	Path
Position:	0
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

Inputs

Microsoft.GroupPolicy.Som

An object that represents a ___domain or an OU.

Outputs