Setting GPO security filter with powershell Set-GPPermissions cmdlet

security powershell filter cmdlet gpo
user1458620 picture user1458620 · Sep 3, 2012 · Viewed 18.2k times · Source

According to Microsoft the cmdlet Set-GPPermissions accepts the option "-replace":

"This ensures that the existing permission level is replaced by the new permission level."

I import a GPO from PowerShell. After that I want to set the security filters. After importing, before setting the security filter, the Security Filtering of the GPO is "Authenticated Users". Now I want to remove that filter option and replace it with "myGroup". To do so I use the following command:

Set-GPPermissions -Name "myGPO" -PermissionLevel GpoApply -TargetName "myGroup" -TargetType Group -replace

The results are that there is a new security filter added which references "myGroup", but the Group "Authenticated Users" is not being removed. The Powershell cmdlet is not replacing the filter, it's adding it.

Hints?

Thanks in advance!

Answer

Ansgar Wiechers picture Ansgar Wiechers · Sep 3, 2012

As documented on the page you referenced, the command would replace already existing permissions of a group "myGroup". It won't replace permissions for a group "Authenticated Users" with permissions for a group "myGroup". Quoting from Technet:

-Replace < SwitchParameter >

Specifies that the existing permission level for the group or user is removed before the new permission level is set.

You'll have to use Set-GPPermissions to grant permissions to "myGroup" and Set-GPPermissions -TargetName "Authenticated Users -PermissionLevel None to remove permissions for "Authenticated Users".

Related questions

Send mail via Gmail with PowerShell V2's Send-MailMessage

I'm trying to figure out how to use PowerShell V2's Send-MailMessage with Gmail. Here's what I have so far. $ss = New-Object Security.SecureString foreach ($ch in "password".ToCharArray()) { $ss.AppendChar($ch) } $cred = New-Object Management.Automation.PSCredential "[email protected]", $…

Read More
Powershell Set-MpPreference -DisableRealtimeMonitoring $true not working correctly

I must warn you I don't use powershell much. I am trying to turn off windows defender real time protection via powershell I found the command Set-MpPreference -DisableRealtimeMonitoring $true and tried it in admin privileges only to get this Set-MpPreference : …

Read More
Add group "Everyone" to directory and all of it's sub-directories

I'm currently using Vista 32-bit. How do I add the Windows security group "Everyone" and give full control to a directory and all of it's sub-directories and all files? Is there a powershell script that I could use? Thanks!

Read More