Build reports and analyze group policies using PowerShell

#Созданные и измененные объекты групповых политик
PS C:\>get-gpo -all | Sort CreationTime,Modificationtime | Select Displayname,*Time

#Находим все объекты групповых политик, измененные за последние 30 дней 
PS C:\>get-gpo -all | Where {$_.ModificationTime -ge (Get-Date).AddDays(-30)}

#Создаем отчет по отдельному объекту групповых политик (Defaul Domain Policy)
PS C:\>Get-GPOReport -name "Default Domain Policy" -ReportType HTML -Path "c:\work\ddp.htm"
invoke-item "c:\work\ddp.htm"

#Создаем отчеты по всем объектам групповых политик
PS C:\>Get-GPOReport -All -ReportType HTML -Path "c:\work\allgpo.htm"
invoke-item "c:\work\allgpo.htm"

#Создаем для каждого объекта групповых политик свой отчет
#заменяем пробелы на _ в имени GPO
PS C:\>Get-GPO -all | foreach { 
 $f="{0}.htm" -f ($_.Displayname).Replace(" ","_")
 $htmfile=Join-Path -Path "C:\work" -ChildPath $f
 Get-GPOReport -Name $_.Displayname -ReportType HTML -Path $htmfile
 Get-Item $htmfile 
}

#requires -version 2.0
#find empty gpos in the domain
Function Get-EmptyGPO {
Param (
[Parameter(Position=0,ValueFromPipeline=$True,
ValueFromPipelinebyPropertyName=$True)]
[string]$DisplayName
)
Begin {
#import the GroupPolicy Module
Import-Module GroupPolicy
}
Process {
#create an XML report
[xml]$report=Get-GPOReport -Name $displayname -ReportType XML
 #totally empty
 if ((-Not $report.gpo.user.extensiondata) -AND (-not $report.gpo.computer.extensiondata)) {
    #no extension data so write
    Get-GPO -Name $Displayname
}
} #process
End {}
} #function
Function Test-EmptyGPO {
Param (
[Parameter(Position=0,ValueFromPipeline=$True,
ValueFromPipelinebyPropertyName=$True)]
[string]$DisplayName
)
Begin {
#import the GroupPolicy Module
Import-Module GroupPolicy
}
Process {
    #set default values
    $User=$False
    $Computer=$False
    #create an XML report
    [xml]$report=Get-GPOReport -Name $displayname -ReportType XML
    if ($report.gpo.user.extensiondata) {
     $User=$True
    }
    If ( $report.gpo.computer.extensiondata) {
     $Computer=$True
    }
    #write a custom object to the pipeline
    New-Object -TypeName PSObject -Property @{
    Displayname=$report.gpo.name
    UserData=$User
    ComputerData=$Computer
    }
} #Process
End {}
} #function
#Get-GPO -All | Get-EmptyGPO
#Get-GPO -All | Test-EmptyGPO

#requires -version 2.0
<#
 Find unlinked GPOs. This requires the Active Directory Module
 This version does not query for site links
 #>
Import-Module ActiveDirectory,GroupPolicy
#GUID regular expression pattern
[Regex]$RegEx = "(([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12})"
#create an array of distinguishednames
$dn=@()
$dn+=Get-ADDomain | select -ExpandProperty DistinguishedName
$dn+=Get-ADOrganizationalUnit -filter * | select -ExpandProperty DistinguishedName
$links=@()
#get domain and OU links
foreach ($container in $dn) {
    #pull the GUID and add it to the array of links
    get-adobject -identity $container -prop gplink | 
    where {$_.gplink} | Select -expand gplink | foreach {
      #there might be multiple GPO links so split 
      foreach ($item in ($_.Split("]["))) {
        $links+=$regex.match($item).Value
      } #foreach item
    } #foreach
} #foreach container
#$links
<#
 get all gpos where the ID doesn't belong to the array
 write the GPO to the pipeline
#>
Get-GPO -All | Where {$links -notcontains $_.id} 

#requires -version 2.0
#find GPOs with extra registry, ie non-ADM settings
Function Test-GPOExtraRegistry {
Param (
[Parameter(Position=0,ValueFromPipeline=$True,
ValueFromPipelinebyPropertyName=$True)]
[string]$DisplayName
)
Begin {
    #import the GroupPolicy Module
    Import-Module GroupPolicy
}
Process {
#create an XML report
[xml]$report=Get-GPOReport -Name $displayname -ReportType XML
#define the XML namespace
$ns=@{q3="http://www.microsoft.com/GroupPolicy/Settings/Registry"}
$nodes=Select-Xml -Xml $report -Namespace $ns -XPath "//q3:RegistrySetting" | 
select -expand Node | Where {$_.AdmSetting -eq 'false'}
if ($nodes) {
  #extra settings were found so get the GPO and write it to the pipeline
  Get-GPO -Name $Displayname
}
}
End {}
} #function
#Import-Module GroupPolicy
#Get-GPO -all | Test-GPOExtraRegistry