HGPM v0.2.0

The first release out of alpha: Install-PSResource -Name HGPM installs it, without -Prerelease.

Added

• Group Policy Modeling, Results and Update, as GPMC: Get-PSGPOModeling (the GPOs a computer and a user would apply, from the directory: the links of the site, the domain and the OUs in the order Windows applies them, the token of the account with its nested groups or a container with its groups, MS16-072, WMI filters assumed true but those given false, empty parts, loopback Merge and Replace, each GPO denied with its reason), Get-PSGPOResult (gpresult /x on Windows, samba-gpupdate --rsop on Linux as root, or their file), Invoke-PSGPOUpdate (gpupdate, Invoke-GPUpdate of RSAT on other computers, samba-gpupdate); the modeling checked against the result on a Windows member and a Samba domain controller
• Starter GPOs, as GPMC: Starter GPOs under the domain (System and Custom, read from SYSVOL\<domain>\StarterGPOs when their node is selected), New Starter GPO... (empty, or with the Administrative Templates of a GPO), New GPO from Starter GPO... and Start from of the New GPO form, Delete Starter GPO...; Get-PSGPOStarterGpo, New-PSGPOStarterGpo, Remove-PSGPOStarterGpo, New-PSGPO -StarterGpo; the files and the extensions GPMC writes, checked on a Windows domain (GPMC reads the Starter GPOs of HGPM and the reverse); audit events 1013 and 1014
• The sites of the forest, as GPMC: Sites beside the domain in the console, each site with its links, read only (their links are changed with GPMC); the links of a GPO include its sites, Find-PSGPO -LinkedTo takes a site and counts a link to a site as a link, Get-PSGPODirectory reads them (Sites), Import-PSGPODirectory takes sites; deleting a GPO linked to a site says that the link stays
• Copy a GPO, as Copy and Paste of GPMC: Copy... (the context menu of a GPO and of a link to it) and Copy-PSGPO, a new GPO of the domain with the files of its folder (settings, comment), its status, client-side extensions and WMI filter, not its links; the permissions of a new GPO, or those of the GPO (-CopyAcl, Preserve the existing permissions), the denied and custom ones said; the copy of a creator of the approval workflow waits for its approval
• Search the GPOs, as the Search of GPMC: Search... (the context menu of the domain and of Group Policy Objects, Ctrl+F) and Find-PSGPO, by name, links (linked nowhere included), WMI filter, permission of an account or a group, client-side extension, text of the settings, status, approval and comment; every criterion given must match, the GPOs read in the background, the results kept while one of them is shown in the tree
• The comment of a GPO, as GPMC (GPO.cmt of its folder, UTF-16): in its details in the console, saved by an account that edits it, without changing its version; Set-PSGPO -Comment, New-PSGPO -Comment, in the report of the GPO, and in the audit log (SetGpoComment, event 1012)
• About in the launcher (Start-HGPM): the version of HGPM installed and the folder it runs from, PowerShell and the system, links to the documentation, the source code and hardenad.net: HGPM is a product of the Hardenad community

Fixed

• The ACL HGPM writes on the SYSVOL folder of a GPO follows the version of Samba of the domain controller, as its samba-tool gpo aclcheck derives it (Samba bug 14927): Windows and Samba 4.23 and later, the allow and deny ACEs without the object ones (Apply Group Policy), Samba 4.17 to 4.22 as before, Samba 4.16 and before the allow ACEs; Get-PSGPODirectory reads the version (ServerVersion, the vendorVersion of the rootDSE). With Samba 4.23, aclcheck said the GPOs whose permissions HGPM had changed were inconsistent

Changed

• The long operations of the GPO console run in the background: Refresh (F5) and Change Domain Controller..., Detect Now (Status tab), Back up and Back up all (History tab), Save report.... The window stays drawn and answers, a banner says what runs, the tree and the details of the domain wait meanwhile, and Cancel stops a read (not a backup, which writes)
• An error that a handler of a window does not catch no longer closes the window: every console says it in a notification at the top right and stays open, and the technical log has it, with the script and the line where it happened (the same error again within 5 seconds is said once)
• The GPO console is split by view, a file each (Initialize-PSGPOManager*View), and its controls are made from its XAML in one loop instead of a line each; a test reads its code and fails on a variable that is neither assigned nor a control of the window

HGPM v0.1.26-alpha

Added

• A backup keeps the owner and the permissions of the GPO, as the Delegation tab lists them; Get-PSGPODrift -IncludePermissions says who was given, or lost, a right on a GPO since its approval, or another owner. An approved version backed up before is said (Permissions: NotRecorded), not compared
• Test-PSGPOHealth finds a GPO whose folder in SYSVOL does not have the permissions of the GPO in the directory, as GPMC (the permissions for this GPO in the SYSVOL folder are inconsistent): an account the folder does not give its rights, or that an ACE of the folder lets change it. The folders of the default GPOs of Windows, given to Administrators, are consistent. On Linux, the ACLs of the folders are read in one connection
• Test-PSGPOSecurityPosture checks the sites of the forest: who can link GPOs to a site, and the GPOs linked to one (their domain controllers apply them)

Changed

• Install-PSGPOAdmx installs the ADMX files of Windows from the package of Microsoft, Administrative Templates (.admx) for Windows 11 2026 Update (26H2), downloaded from download.microsoft.com, instead of a copy kept in the repository of HGPM: those files are Microsoft's, and HGPM no longer redistributes them. The module pins the package (its size and SHA-256) and its files, as before; the package is extracted without being installed (msiexec /a on Windows, msiextract of msitools on Linux and macOS). -MsiPath installs from the package downloaded on another computer; -Ref is gone. The languages are installed in folders named after their culture (fr-FR), as in Windows
• The repository no longer holds the ADMX files of Microsoft, its history included: CI/Get-AdmxSource.ps1 installs them from the package for the tests

Documentation

• Audit on the domain controllers: what Windows (the audit policy, the SACLs, events 5136, 5137, 5141, 4663) and Samba (dsdb_json_audit and vfs_full_audit in smb.conf, each line explained) log of a change made to the GPOs with another tool than HGPM; tested on Samba

HGPM v0.1.25-alpha

Added

• The domain and each OU have the tabs of GPMC: Linked GPOs, their links by link order with the state of each (enforced, enabled, the status and the WMI filter of the GPO), and Move to top, Move up, Move down, Move to bottom to change the order of application where the account links GPOs (link order 1 wins), each change audited; Inheritance, the GPOs that apply there by precedence and where each is linked, the enforced links first, an OU that blocks the inheritance said
• Get-PSGPOInheritance, as Get-GPInheritance of the GroupPolicy module: the links of the domain or an OU by link order (GpoLinks), whether it blocks the inheritance, and the GPOs that apply there by precedence (InheritedGpoLinks)

HGPM v0.1.24-alpha

Fixed

• History tab: the line of the timeline was not straight, the backups with a label (Approved) a little higher than the others: the nodes are now aligned at the top
• Restricted groups: an account typed in the list of the members, or of the groups the group is a member of, was suggested nothing (HardenSamba/HardenBox#5); the suggestions were in one box above both lists, little seen. Each list now has its own box below it, with the suggestions, Add (or Enter) and Remove, as GPMC and the user rights; its accounts are shown by their name and their SID, the names of the accounts of the domain read from it. An account typed and not added stops the save, and is named
• A box of accounts (a restricted group, a user right, the members of a local group of the preferences) emptied once the account was added got its text back a moment later, from the suggestion picked or the search still running

HGPM v0.1.23-alpha

Security

• Initialize-PSGPOWorkflow -Apply gives the creators nothing, and stops (a script that delegates stops with it), while the domain has no central store (Policies\PolicyDefinitions): a creator that creates folders in Policies could create it, own it, and choose the ADMX files every console reads. It is not created empty (an empty central store hides the administrative templates of GPMC): Install-PSGPOAdmx -CentralStore fills it. When the creators create folders already, it warns; its last row says whether Tier 0 owns the central store, and how to take it back otherwise

Added

• Test-PSGPOSecurityPosture: who can create, change and link GPOs beyond Tier 0 and the workflow (Group Policy Creator Owners, CN=Policies, the GPOs and the links of the domain and of the domain controllers, a group of every account anywhere), who owns or changes the Policies folder, the central store and the configuration of HGPM in SYSVOL, and what the configuration leaves open. It only reads, as an account of no group; -SystemLog sends a summary (event 4000) and each High finding (event 4001) to the log of the system, for a SIEM

Documentation

• Hardening: the security posture, tested on both labs; Production: the central store before the delegation, the posture checked each day by a gMSA or a keytab

HGPM v0.1.22-alpha

Added

• Suggestions while typing an account: the well-known accounts of every computer and of every domain (Domain Admins, Key Admins... with the SID of the domain read), by their English or French name or their SID, then the accounts of the domain whose name begins with what is typed. In a restricted group, its members and the accounts of a user right, the account is written as its SID (*S-1-5-32-544), as GPMC does; in the delegation, the security filtering and the approval of a GPO, by its name. A local group of the preferences suggests the groups of every computer (Administrators (built-in)) and fills their SID, its members are picked with their SID
• A registry preference suggests the keys of the loaded ADMX files for its hive, with the policies that write them, then the value names of the key; it warns when a policy manages the key (a preference tattoos the computers: the value stays when the GPO no longer applies)
• Approve-PSGPO -ApplyTo and -DenyTo, Set-PSGPOPermission -Account and Set-PSGPOWmiFilterPermission -Account complete the well-known accounts with Tab
• One table of the well-known accounts (72: Builtin, NT AUTHORITY, and the RIDs of a domain, Enterprise Read-only Domain Controllers, Cloneable Domain Controllers, Key Admins, Enterprise Key Admins, RAS and IAS Servers and the RODC password replication groups included), in English and French, for the names shown and the names typed (page Well-known accounts)

Fixed

• A name of a well-known account in the language of another domain controller was not found: Domain Admins (the default roles of the configuration) on a French domain controller, where it is Admins du domaine, and the French names on an English one; a well-known account of the domain is now found by its RID. *S-1-..., as GptTmpl.inf writes an account, is accepted wherever an account is typed

Documentation

• Offline installation: the strict check of an attestation, the release workflow and the tag required (gh attestation verify --signer-workflow ... --source-ref ...)

HGPM v0.1.21-alpha

Security

• The module published is the one the tests ran: the CI builds it once (job build), every job tests that one, and the release publishes it, where it built the module again. The build is reproducible (no date, the sources in the order of their names, LF line endings): the same bytes on Windows and on Linux, which the CI checks at each commit
• Each release lists the SHA-256 of every file of the module and of every archive (SHA256SUMS), attested by GitHub (gh attestation verify <file> --repo JM2K69/PSGPOTools); with the secrets CODE_SIGNING_PFX and CODE_SIGNING_PASSWORD, its scripts are signed with Authenticode and timestamped, with a catalog HGPM.cat of all its files
• The Avalonia runtime is checked file by file each time the console loads it (the SHA-256 of each file of each runtime pinned in the module), and a library added next to it is refused, before anything of it is loaded: a runtime changed in the folder of the module or of the user no longer runs in the console of an administrator
• The CI reads the repository only, and the release job has the rights it needs; the actions are pinned to a commit (Dependabot proposes their new versions), Pester, PSScriptAnalyzer and the site generator to a version

Added

• Offline archives in each release: the module with the Avalonia runtime of win-x64, win-arm64, linux-x64 and linux-arm64, for the computers without internet (page Offline installation)
• PSGPOTOOLS_NUGET_SOURCE: the Avalonia packages from an internal NuGet feed (its index.json or the base address of its packages) or a folder of .nupkg files instead of nuget.org, checked the same; a download is tried three times, two minutes each

HGPM v0.1.20-alpha

Added

• Test-PSGPOHealth checks the GPOs of the domain as GPMC and gpotool, and returns one row per problem, nothing when there is none: on the baseline (the domain controller read, its PDC emulator), a GPO redirected, without its folder or its GPT.INI, or whose versions differ between the directory and SYSVOL (errors); a file of settings (Registry.pol, GptTmpl.inf, audit.csv, scripts.ini, the preferences) whose client-side extension the GPO does not declare, so that the computers do not apply it, a folder of SYSVOL without a GPO, a link to a GPO of the domain that does not exist, and the other domain controllers that differ or cannot be read (warnings)
• Get-PSGPOReplicationStatus compares the GPOs of each domain controller of the domain, in its directory and in its SYSVOL, to those of the baseline: one row per GPO and domain controller (InSync, DirectoryDiffers, SysvolDiffers, Missing, Extra, OrphanFolder, Unreachable) with their versions. SYSVOL is listed once per domain controller, and on Linux the GPT.INI of every GPO read in one smbclient
• The Status tab of the domain, as the one of GPMC (Group Policy Infrastructure Status): Detect Now shows the domain controllers, in sync or with a replication in progress, and the problems of the GPOs

Documentation

• Installation: the cache of the ADMX files, when it is written, read or not written, and how to clear it

HGPM v0.1.19-alpha

Security

• A change of a GPO no longer stops halfway: its files are written aside then renamed over the former ones (a computer reads the former file or the new one), and put back as they were when a file cannot be written or the directory refuses the new version (the GPO changed meanwhile, a right, the server gone), the restore of a backup included; SYSVOL kept the new files with a version ahead of the directory, and the computers applied a change the console said was not saved
• Linux: the Kerberos ticket of the session is checked (klist -s) before SYSVOL or the directory is reached: an expired ticket says run kinit, nothing changed, instead of errors that did not say it after part of the change

Added

• As GPMC, the domain is read from its PDC emulator (the fSMORoleOwner of the domain), found by the domain controller the computer reaches, and the changes go there; Get-PSGPODirectory -Server another domain controller warns, the status bar says not the PDC emulator, and Change Domain Controller... (right click on the domain) lists the domain controllers, the PDC emulator first, and reads the domain again from the one chosen
• The details of a GPO show its versions in the directory and in SYSVOL, as GPMC (User version: 2 (AD), 2 (SYSVOL)), and say when they differ: the computers apply SYSVOL

HGPM v0.1.18-alpha

Changed

• The GPO console opens at once: the ADMX files, of the central store of the domain shown as in GPMC (not of the domain of the computer), or of the folder chosen instead in the window of the ADMX files (a folder chosen while no store was reached is taken after the stores), are read the first time it needs them (the policy editor, the Settings and History tabs, a report), under a banner, and what was asked for meanwhile runs once they are loaded; a console that only links, delegates or approves never reads them. The window of the ADMX files opens only when there are none, or at the next start after a load that failed: it opened at each start, and the console waited for the files before it showed. With -NoDirectory, they are loaded before the editor shows
• The ADMX files of a folder are parsed once, then read from a cache of the user (%LOCALAPPDATA%\PSGPOTools\Admx on Windows; $XDG_CACHE_HOME/PSGPOTools/Admx, else ~/.cache/PSGPOTools/Admx elsewhere) while they keep their names, sizes and dates, for the same HGPM.psm1: about a second instead of five to thirteen on Windows, where each console opens in a process of its own. A load with an error, or with a file left out for a reason that may pass (the network, the rights), is not cached, and Initialize-PSGPOAdmx -NoCache parses the files. The cache gives the objects the files give, to the last property, and shows the warnings of the files again
• As the Group Policy editor, an ADMX file without an ADML in the language takes the one of en-US (a template shipped in English only, as LAPS), and a file that cannot be read is left out with a warning, named in the banner of the console: either failed the whole load. A load where no file can be read fails
• The ADMX parser reads the XML elements directly rather than through the adapter of PowerShell

Fixed

• The explanation of a policy written in a CDATA section of the ADML (Require special characters of Windows Hello for Business) was empty
• The ADMX files loaded again in the same session (another language, another folder): the Settings tab, the configured settings and the reports named the settings with the policies of the former load when there were as many
• A load of the ADMX files that failed left the policies read before the failure: it now loads nothing (Initialize-PSGPOAdmx), and the console says that it runs without them