Append-All-Processed-Group-Policy-Denies

Append-All-Processed-Group-Policy-Denies

This command makes changes to your existing group policies, so a backup is made in the user's home directory before each change

If two policies linked at the same OU both try to define the same item, only the one with highest precedence "wins".  This is not ideal for settings where we want to apply a list of several values: It would be convenient if multiple policies could collaborate and pool their values into one big list, which would then get applied.  But unfortunately, that's not how it works.

If the Check-Group-Policy command identified any OUs where there is a non-AuthLite policy applying Computer -> User Rights Assignment -> Deny items, that means those computers won't see the inherited AuthLite policy value.

We want to keep whatever the existing policy is doing, but we also  want the AuthLite enforcement to work.  Since having two policies trying to set the same list makes only the highest precedent one apply, we need a way to accomplish both things within that constraint. 

Therefore, this powershell command (auto-run during Do-GP-Setup) will edit existing policies that have Deny items defined.  It simply adds the AuthLite 1-Factor Session Tag group to whichever Deny items the existing policy already defines. This makes the policies keep doing what they were doing before, and now also apply the AuthLite rule.