Command line options?

[tsherrington]

Hi there,
Is there a way I can configure policies on one computer using Policy Plus (which is a brilliant program), then copy them to another computer and apply them via command line?

Thanks,

Thane

[Fleex255]

Probably the easiest way to do this is to export your policy settings to REG files and apply them with reg import. The disadvantage is that they would only be written to the Registry, not the local GPO, so you wouldn't see them if you opened Policy Plus on the target computer. To include all policy settings in your local GPO, you can directly use Share | Export REG to export all. If you just want specific options, one way is to create a new POL file using Policy Plus, set just the settings you want, and export all from that to REG.

If you want to import into the real local GPO, you will need to create a POL file and actually use Policy Plus for the import. There isn't an official command line interface (yet?), but since it's .NET you can use its components from PowerShell as a workaround. The sample code in #5 might get you started.

[God-damnit-all]

Probably the easiest way to do this is to export your policy settings to REG files and apply them with reg import. The disadvantage is that they would only be written to the Registry, not the local GPO, so you wouldn't see them if you opened Policy Plus on the target computer. To include all policy settings in your local GPO, you can directly use Share | Export REG to export all. If you just want specific options, one way is to create a new POL file using Policy Plus, set just the settings you want, and export all from that to REG.

If you want to import into the real local GPO, you will need to create a POL file and actually use Policy Plus for the import. There isn't an official command line interface (yet?), but since it's .NET you can use its components from PowerShell as a workaround. The sample code in #5 might get you started.

Being able to export individual reg or pol files for individual policies would be an amazing feature.

[casaqori]

I am using this powershell workflow:

Have .reg files being deployed to target machine, e.g.
defenderPolicy.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan]
"DisableRemovableDriveScanning"=dword:00000001

regedit /s %~dp0defenderPolicy.reg

Import these to Local Group Policies:
SyncRegToPol.ps1

[System.Reflection.Assembly]::LoadFile("$PSScriptRoot\PolicyPlus.exe") | Out-Null
$main = New-Object PolicyPlus.Main

$compGpoLoader = New-Object PolicyPlus.PolicyLoader ('LocalGpo', '', $false)
$compGpoSrc = $compGpoLoader.OpenSource()
$compRegLoader = New-Object PolicyPlus.PolicyLoader ('LocalRegistry', 'HKLM', $false)
$compRegSrc = $compRegLoader.OpenSource()
$compRegFile = $main.GetOrCreatePolFromPolicySource($compRegSrc)
$compRegFile.Apply($compGpoSrc) | Out-Null
$compGpoLoader.Save() | Out-Null
$compGpoLoader.Close()

Update Policy Store (or restart instead)

gpupdate

[God-damnit-all]

Annoyingly, doesn't work in PowerShell 7 by default due to the removal of BinaryFormatter: https://devblogs.microsoft.com/dotnet/binaryformatter-removed-from-dotnet-9/

You'd either have to use 5.1 or that legacy package it talks about in the article...

EDIT: After futzing with it, I don't think it's possible to use the legacy package with PowerShell 7 unless you compiled it into PowerShell directly.

[beedell-roke]

After futzing with it, I don't think it's possible to use the legacy package with PowerShell 7 unless you compiled it into PowerShell directly.

@God-damnit-all, why?

[God-damnit-all]

After futzing with it, I don't think it's possible to use the legacy package with PowerShell 7 unless you compiled it into PowerShell directly.

@God-damnit-all, why?

It's explained why in the link. PowerShell 7 is built on .NET 9.

[beedell-roke]

@God-damnit-all, however, aren't you referring to System.Runtime.Serialization.Formatters, which was explicitly released for this purpose? ¹ If it doesn't work, I'm interested in why, because the newsletter certainly doesn't explain why. It recommends it.

Footnotes

1. github.com/dotnet/docs/blob/3f63aab5d1ba709598f3b31f36528efcddaab71e/docs/standard/serialization/binaryformatter-migration-guide/compatibility-package.md ↩

[God-damnit-all]

@God-damnit-all, however, aren't you referring to System.Runtime.Serialization.Formatters, which was explicitly released for this purpose? 1 If it doesn't work, I'm interested in why, because the newsletter certainly doesn't explain why. It recommends it.

Footnotes

1. github.com/dotnet/docs/blob/3f63aab5d1ba709598f3b31f36528efcddaab71e/docs/standard/serialization/binaryformatter-migration-guide/compatibility-package.md ↩

Yes but you have to directly compile it into PowerShell because you have to set a compatibility switch as well: https://devblogs.microsoft.com/dotnet/binaryformatter-removed-from-dotnet-9/#binaryformatter-compatibility-package