GPOOutline – The Shape
of Your Group Policy
A practical, read-only PowerShell tool for documenting Group Policy
across an Active Directory forest
GitHub:
github.com/SanthoshSivarajan/GPOOutline
GPOOutline – self-contained Group Policy documentation report
Group Policy has been part of Active Directory environments
for decades, but in many organizations it remains one of the least documented
areas of the infrastructure.
Administrators may know individual GPOs and where some
policies are linked, but getting a complete picture of how Group Policy is
configured across an entire forest can still be difficult. Group Policy
information lives in both Active Directory and SYSVOL, and understanding the
environment requires bringing those pieces together.
That is the reason I created GPOOutline.
GPOOutline is a single-file, read-only PowerShell tool that
documents how Group Policy is configured across an Active Directory forest and
produces one self-contained HTML report. The goal is simple: show what is
configured today, how it is connected, where it applies, and what the
environment actually looks like.
Why GPOOutline?
Group Policy settings are spread across directory objects,
SYSVOL files, links, filters, permissions, WMI filters, scripts, preferences,
and inheritance rules. Looking at one GPO at a time does not always answer the
broader operational questions.
GPOOutline is designed to help answer questions such as:
·
What GPOs exist across the forest?
·
Where is each GPO linked?
·
What applies to a particular OU?
·
Which policy wins when multiple GPOs configure
the same setting?
·
Where is inheritance blocked or a link enforced?
·
Which GPOs are unlinked, empty, disabled, or
otherwise have little runtime effect?
·
Who can edit or delegate a GPO?
·
What WMI filters, scripts, preferences, and
client-side extensions are being used?
·
Are AD and SYSVOL versions consistent?
·
What Group Policy information should be
understood before consolidation, migration, audit, or handover?
Design Philosophy
GPOOutline was intentionally built to keep collection
simple, transparent, and portable.
It is a single PowerShell script. There is no installer,
agent, database, RSAT requirement, GPMC requirement, ActiveDirectory module
requirement, or GroupPolicy module requirement for normal collection. The tool
reads Group Policy metadata through LDAP and reads policy configuration from
SYSVOL. It does not modify Active Directory or SYSVOL.
The output is a self-contained HTML report that can be
opened offline, plus a JSON state file that can be used to regenerate the
report without touching the directory again.
GPOOutline collection running from PowerShell
What GPOOutline Records
1. Forest and Domain Context
The report starts with environment context, including forest
and domain information, functional levels, domain controllers, PDC emulators,
sites, trusts, SYSVOL replication method, and Central ADMX Store status. This
provides the background needed to understand the Group Policy configuration
that follows.
2. GPO Inventory and Scope of Management
GPOOutline provides a high-level inventory of the Group
Policy environment, including GPO counts, links, enabled and disabled states,
enforced links, and other scope-related information. This gives you a quick
view before you move into individual GPOs.
GPO inventory and scope of management
3. Every GPO in Detail
Each GPO can be reviewed in detail, including identity,
domain, GUID, timestamps, status, AD and SYSVOL versions, links, link order,
enforcement, security filtering, delegation, WMI filters, client-side
extensions, comments, and evidence paths. This helps reduce the need to move
between several management interfaces just to understand one GPO.
Detailed GPO inventory and configuration view
4. Group Policy Settings
GPOOutline reads and documents the major Group Policy
setting areas, including Administrative Templates, security settings, audit
policy, scripts, software installation, folder redirection, and Group Policy
Preferences. Administrative Template registry settings can be decoded and,
where available, resolved to ADMX-friendly names.
5. OU Tree, Links, and Scope
Understanding a GPO by itself is only part of the story.
GPOOutline builds an OU-based view so you can see where policies are linked,
how link order is configured, where inheritance is blocked, and where enforced
links affect processing.
OU tree with GPO links and inheritance context
6. Resultant Precedence
When multiple GPOs configure overlapping settings, the
important question is which setting ultimately wins. GPOOutline computes
resultant precedence using the normal Group Policy processing model, including
site, domain, OU layering, nested OUs, link order, block inheritance, and
enforced links.
Resultant Group Policy precedence by container
7. Loopback, Site Links, and Anomalies
Loopback processing can make Group Policy troubleshooting
difficult, especially in RDS, Citrix, kiosk, shared-device, and administrative
workstation scenarios. GPOOutline identifies loopback mode and scope. It also
calls out site-linked GPOs and configuration anomalies such as unlinked, empty,
disabled, mismatched, missing, or unreachable policy objects.
Loopback processing, site-linked GPOs, and orphan/anomaly views
8. Cross-Reference Mapping
Cross-reference views make it easier to answer both
directions of the relationship: where is this GPO used, and which GPOs affect
this container? GPOOutline provides GPO-to-container and container-to-GPO views
to make those relationships easier to navigate.
GPO-to-container and container-to-GPO mapping
9. WMI Filters and Client-Side Extensions
GPOOutline identifies WMI filter usage and the client-side
extensions used across the environment. This is useful for documentation,
troubleshooting, consolidation, and understanding which processing components
are actually in use.
WMI filter usage and client-side extension inventory
10. Behavior and Runtime Impact
The report also provides visibility into behavior-related
areas such as processing characteristics, setting footprint, tattooing
indicators, and GPOs that appear to have no runtime effect. These are
documentation signals, not automatic recommendations to remove anything.
Tattooing indicators and GPOs with no runtime effect
What GPOOutline Does Not Do
GPOOutline is intentionally a documentation tool, not an
assessment engine. It does not provide risk scoring, grades, health scores,
traffic-light ratings, automatic remediation advice, endpoint scanning, or
configuration changes. It records the current state and leaves interpretation
and remediation decisions to an assessment or a human reviewer.
Common Use Cases
·
Active Directory and Group Policy documentation
·
Assessment preparation
·
GPO consolidation and cleanup planning
·
Intune migration discovery and planning
·
Mergers and acquisitions
·
Active Directory migration
·
Audit and compliance documentation
·
Operational handover and knowledge transfer
·
Troubleshooting scope, inheritance, filtering,
precedence, and loopback
Requirements
·
Windows PowerShell 5.1 or PowerShell 7.x
·
Domain-joined Windows system, or another Windows
host with line of sight to a domain controller when -Server and -Credential are
used
·
LDAP connectivity to a domain controller
·
SMB access to SYSVOL for full setting collection
·
Write access to the output folder
·
No RSAT, GPMC, local administrator rights, or
WinRM required for normal collection
|
Port |
Service |
Purpose |
|
389/TCP |
LDAP |
Directory
collection |
|
88/TCP |
Kerberos |
Authentication |
|
445/TCP |
SMB |
SYSVOL
parsing |
How to Use GPOOutline – Step by Step
Step 1 – Download the Tool
Download or clone the repository from: https://github.com/SanthoshSivarajan/GPOOutline
The primary script is GPOOutline.ps1. Copy it to a
management workstation, jump box, or other Windows system that can reach the
target Active Directory environment.
Step 2 – Open PowerShell
Open PowerShell and change to the folder containing the
script.
cd C:\Tools\GPOOutline
Step 3 – Run a Standard Forest-Wide Collection
From a domain-joined system, the simplest run is:
.\GPOOutline.ps1
The script discovers the environment, validates
connectivity, and begins collection. The console shows progress through the
different collection phases.
Step 4 – Review the Output Files
A normal run creates three primary files:
GPOOutline_<forest>_<stamp>.html
GPOOutline_<forest>_<stamp>.state.json
GPOOutline_<stamp>.log
·
HTML report – the self-contained report you open
in a browser.
·
State JSON – the complete collected dataset used
to regenerate the report without reconnecting to AD.
·
Log file – structured collection details useful
for troubleshooting and validation.
Step 5 – Open the HTML Report
Open the generated HTML file in a browser. The report is
self-contained and does not require a web server, database, or connection back
to Active Directory.
Additional Usage Examples
Run from a non-domain-joined machine:
.\GPOOutline.ps1 -Server
dc01.contoso.com -Credential (Get-Credential)
Scope to specific domains and choose an output folder:
.\GPOOutline.ps1 -Domain
corp.contoso.com,emea.contoso.com -OutputPath C:\Reports
Limit collection to an OU subtree:
.\GPOOutline.ps1 -SearchBase
"OU=Europe,DC=contoso,DC=com"
Preview the size of the collection before running it:
.\GPOOutline.ps1 -WhatIfScope
Perform a fast metadata-only pass without SYSVOL setting
collection:
.\GPOOutline.ps1 -SkipSysvol
Reduce concurrency for a busy environment:
.\GPOOutline.ps1 -MaxConcurrency 4
-ThrottleDelayMs 50
Regenerate the HTML report from a previously collected state
file without touching Active Directory:
.\GPOOutline.ps1 -FromState
.\GPOOutline_contoso_com_20260816_141500.state.json
Useful Parameters
|
Parameter |
Purpose |
|
-Server |
Target domain
controller or domain |
|
-Credential |
Alternate
credentials; useful for non-domain-joined collection |
|
-Domain |
Limit
collection to selected domains |
|
-SearchBase |
Limit OU/link
collection to a subtree |
|
-OutputPath |
Choose output
directory |
|
-MaxConcurrency |
Control
parallel SYSVOL workers |
|
-ThrottleDelayMs |
Add delay
between batches |
|
-SkipSysvol |
Metadata-only
collection |
|
-IncludeSites |
Include
site-linked GPOs |
|
-ResolveAdmx |
Resolve
ADMX-friendly names |
|
-WhatIfScope |
Preview the
collection work list |
|
-FromState |
Regenerate
from an existing state file |
|
-NoHtml /
-NoState |
Suppress one
of the normal outputs |
|
-ExcludeDC |
Do not
contact selected domain controllers |
|
-ShowDetail |
Show
additional console detail |
Where GPOOutline Fits in the Tool Family
I use four related tool families, each answering a different
question:
|
Series |
Question |
|
Outline |
What is
configured right now? |
|
Atlas |
How is it
structured, and what connects to what? |
|
Canvas |
What does it
mean, and where should I look? |
|
Lens |
What changed
since last time? |
GPOOutline belongs to the Outline series. Its purpose is
current-state documentation without scoring or remediation recommendations.
ADOutline is the closest sibling for documenting the broader Active Directory
forest. GPOLens is planned as a separate interpretation layer for Group Policy
modernization and Intune migration scenarios.
More of My Work
·
GitHub – all tools and repositories
·
LinkedIn
Download GPOOutline
GPOOutline is available here: https://github.com/SanthoshSivarajan/GPOOutline
If you work with Active Directory and Group Policy, give it
a try and review the report in your own environment. Feedback, testing, issue
reports, and community contributions are always welcome.
“If someone asked you today to show
them exactly how Group Policy is configured across your environment, could
you?”
GPOOutline is designed to help you answer that question.
0 comments:
Post a Comment