Check-Group-Policy

Check-Group-Policy

Analyzes group policy in the domain for all use of the Computer -> User Rights Assignment -> "Deny" items, and prints its output as a colorized tree of OUs. During initial setup, this information is also used to target where existing policies need to be edited to add AuthLite rules.

After initial setup, the goal of this command is to find whether any OUs are missing any Deny items for the AuthLite 1-Factor Session Tag  group, and highlight those items in yellow (if another policy is applied there) or purple (if the setting is not applied at all).

If you purposefully make exceptions to the policy or limit its scope, items under these OUs will also show as yellow or purple. It does not have any way to tell the difference between accidental omissions and purposeful choices.

If the output of the report scrolls past the limit of the buffer, a transcript is also made in the file GroupPolicy.txt. It does not show color formatting, however.