Skip to main content

Register-DMGPPermissionFilter

SYNOPSIS​

Registers a GP Permission filter rule.

SYNTAX​

Managed​

Register-DMGPPermissionFilter -Name <string> -Managed <bool> [-Reverse] [-ContextName <string>]
 [<CommonParameters>]

Path​

Register-DMGPPermissionFilter -Name <string> -Path <string> [-Reverse] [-PathScope <string>]
 [-PathOptional] [-ContextName <string>] [<CommonParameters>]

GPName​

Register-DMGPPermissionFilter -Name <string> -GPName <string> [-Reverse] [-GPNameMode <string>]
 [-ContextName <string>] [<CommonParameters>]

DESCRIPTION​

Registers a GP Permission filter rule. These rules are used to apply GP Permissions not on any one specific object but on any number of GPOs that match the defined rule. For example it is possible to define rules that match GPOs by name, that apply to all GPOs defined in configuration or to GPOs linked under a specific OU structure.

EXAMPLES​

EXAMPLE 1​

Get-Content .\gppermissionfilter.json | ConvertFrom-Json | Write-Output | Register-DMGPPermissionFilter

Reads all registered filters from the input file and registers them for use in testing Group Policy Permissionss.

PARAMETERS​

-ContextName​

The name of the context defining the setting. This allows determining the configuration set that provided this setting. Used by the ADMF, available to any other configuration management solution.

Type: System.String
DefaultValue: <Undefined>
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-GPName​

Name of the GP to filter for. This can be a wildcard or regex match, depending on the -GPNameMode parameter, however by default an exact match is required. Subject to name insertion.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: GPName
  Position: Named
  IsRequired: true
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-GPNameMode​

How exactly the GPName parameter is applied:

  • Explicit: An exact name equality is required (default)
  • Wildcard: Supports wildcard comparisons (using the -like operator)
  • Regex: Supports regex matching (using the -match operator) None of the three options is case sensitive.
Type: System.String
DefaultValue: Explicit
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: GPName
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Managed​

Matches GPOs that are defined by ADMF ($true) or not so ($false).

Type: System.Boolean
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Managed
  Position: Named
  IsRequired: true
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Name​

Name of the filter rule. Must only contain letters, numbers and underscore.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: true
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Path​

Matches GPOs that have been linked to the specified organizational unit (or potentially OUs beneath it). Subject to name insertion.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Path
  Position: Named
  IsRequired: true
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-PathOptional​

Whether the path is optional. By default, when evaluating a path filter, processing of GP permission terminates if the designated path does not exist, as we cannot guarantee a consistent permission-set being applied. With this setting enabled, instead processing silently continues. (Even if this is enabled, a silent log entry will be added for tracking purposes!)

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Path
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-PathScope​

Defines how the path rule is applied:

  • Base: Only the specified OU's linked GPOs are evaluated (default).
  • OneLevel: Only the OU's directly beneath the specified OU are evaluated for linked GPOs.
  • SubTree: All OUs under the specified path are avaluated for linked GPOs.
Type: System.String
DefaultValue: Base
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Path
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Reverse​

Reverses the result of the rule. This combined with another condition allows reversing the result. For example, combined with a Path condition, this would make the filter match any GPO NOT linked to that path.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.