powershell端点GPO更新

Question

In my environment we have roughly 20k endpoints. GPOs get pushed but not "managed" at least not audited well. The end goal is to have the ability to query a single endpoint and determine the last GPO update that it received and 'enabled'. Ultimately a timestamp-ish type attribute would be optimal because we are trying to look into endpoints that are outliers and have not responding to long time GPOs. Im trying to get this functionality in Powershell becasue we already have a multithreaded script for our domain attribute collections- i just want to bake this in as well. I have already looked over the GroupPolicy Module commands and am not really seeing a way to get specific instances for specific endpoints. I did read about a possibility of GPO updates being stored in the registry? Any help is very appreciated.

Answer 1

I would say look at event log of the systems as that will get you a time stamp. You are right, you can find it in the registry . However, I was not able to see any kind of time stamp when these GPOs were applied.

It might take a little bit to develop the code as event logs are a bit of a headache to work with in POSH, BUT it will be worth it in the end. The path for the event logs on a system is this "Applications and Services Logs -> Microsoft -> Windows -> Group Policy". The event code by looking at my system is 5117 for the operational event log. This should be a good starting place for you.