Multiple GPOs into one MOF file

[armentpau]

Would it be possible for the BaselineManagment module to combine multiple GPOs into one MOF file? I would like to be able to combine the multiple GPOs into one MOF file for import into DSCEA for scanning against a computer to see if it is in compliance.

An example of what I am trying to accomplish: Where I work we have a Windows 10 baseline with a further baseline based on region/department defined in GPO. It would be nice if all of the GPOs could be combined into one MOF file for use by DSCEA. To allow for the resolution engine to work properly, I'm thinking it should process the GPO baselines in reverse order of GPO application for a given OU - this would ensure that the last GPO would have its settings applied first and therefore be the setting to win out when multiple GPOs are involved (if i'm reading the conflict resolution engine correctly)

I did a little playing around with the current module and with some slight changes was able to get it to take in multiple GPOs and combine them into one MOF file using the conflict resolution engine to comment out conflicting entries for the same settings. It would take some refinement to get it to do the correct ordering of the GPO but I think it is something that would be feasible and worthwhile.

Thoughts?

[armentpau]

I should clarify my statment - that is - it should go in order of precedence in the inheritance window

[tmmuessig]

+1 on this.

Here is how I see it working. I have an OU for lets say Win10 machines that have 4 GPO's applied (GP1, GP2, GP3, GP4). The link order, for sake of argument is as the GPOs are, so 1,2,3,4. I would like to back them up to a folder and then call the command:

ConvertFrom-GPO -GPO GOP1, GPO2, GPO3, GPO4 -Path .\BackedUpGPO -FollowLinkOrder:$True

In the example, replace GPO1, GPO2, GPO3, GPO4 with the actual GUID of the GPO. What I envision -FollowLinkOrder:$True does is take the gpos passed with -GOP in order. So if I pass the GPOs as GPO2, GPO3, GPO1, GPO4 it would create the MOF file with the settings in that order.

[dineshsharmads]

I name the GPO backup directories as 1_, 2_ and the module picks up in order and comments out any conflicting policies using conflict resolution engine.

[canix1]

Check out the new function Merge-GPOs. It will grab all applied GPOs for one computer and makes a MOF-file.