Skip to main content

Group Policy Ownership

Synopsis​

Define the desired owner for Group Policy Objects and enforce consistent GPO ownership across the domain.

Description​

Every Group Policy Object has an owner in Active Directory. This component allows you to declare who should own GPOs, so ADMF can detect and correct ownership that has drifted from the desired state.

Ownership can be defined in three mutually exclusive modes:

  • Explicit — targets a single, named GPO.
  • Filter — targets any GPO matching a filter expression (uses the same filter syntax as GP Permissions).
  • Global — a catch-all default that applies to any GPO not covered by an explicit or filter rule.

When multiple rules could match the same GPO, this precedence applies:

Explicit > Filter > Global

When multiple filter rules match, the one with the lowest Weight value takes effect.

This component works in conjunction with Group Policy Permissions and GP Permission Filters.

Example Configuration​

Set a global default owner for all GPOs (catch-all):

[
    {
        "All": true,
        "Identity": "%DomainName%\\Domain Admins"
    }
]

The same default rule in psd1 format:

@(
    @{
        All      = $true
        Identity = '%DomainName%\Domain Admins'
    }
)

Set the owner of a specific GPO explicitly:

[
    {
        "GpoName": "Tier 0 - Domain Controller Baseline",
        "Identity": "%DomainName%\\Tier0-GPO-Admins"
    }
]

Use a filter to assign ownership to all managed Tier 0 GPOs to ti, with a higher priority than the global default: A more complex assignment:

  • Assigns ownership over all managed tier 0 GPOs to the group Tier0-GPO-Admins.
  • Assigns ownership over all managed PKI GPOs to the group Tier0-PKI-Admins. This takes precedence over the previous rule.
  • Assigns ownership over all other GPOs to the group Domain Admins (by SID which is language-neutral).
[
    {
        "Filter": "IsManaged -and Tier0",
        "Weight": 20,
        "Identity": "%DomainName%\\Tier0-GPO-Admins"
    },
    {
        "Filter": "IsManaged -and PKI",
        "Weight": 10,
        "Identity": "%DomainName%\\Tier0-PKI-Admins"
    },
    {
        "All": true,
        "Identity": "%DomainSID%-512"
    }
]

Properties​

GpoName​

Optional: No | Default: None | ParameterSet: Name

This parameter uses name resolution.

The name of the specific GPO this ownership rule applies to.

Filter​

Optional: No | Default: None | ParameterSet: Filter

A filter expression that selects which GPOs this rule applies to. Uses the same filter syntax as GP Permissions — a PowerShell-syntax boolean expression whose conditions are GP Permission Filter names.

For example:

  • "IsManaged -and Tier0"
  • "-not (IsManaged) -or (Tier1 -and UserScope)"

All conditions referenced in the filter must be defined as GP Permission Filters.

Weight​

Optional: Yes | Default: 50

The precedence order when multiple filter rules match the same GPO. Lower numbers take higher priority. The filter rule with the lowest Weight value is the one that applies.

All​

Optional: No | Default: False | ParameterSet: All

This rule is the global default, if no other rule applies to a GPO.

Only one global default can be active at a time; registering a new one replaces the previous.

Identity​

Optional: No | Default: None

This parameter uses name resolution.

The identity (user or group) that should be the owner of the affected GPO(s). Accepts an NT identity reference (e.g. CONTOSO\Domain Admins) or a SID.