powershellldapldap-querygroup-policyadsi

Edit gPCMachineExtensionNames Attribute via Powershell


I have to modifiy the gPCMachineExtensionNames Attribute string from a group policy in active directory with powershell. For this, I first want to read the existing string, modify this and replace the old with the modified.

The attribute is defined in the policy container under: CN={POLICY GUID}, CN=Policies, CN=System, DC=[DOMAIN], DC=[COM]

When I browse the attribute with ADSI Edit, the value of the gPCMachineExtensionNames is correctly shown as [{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}]

I try to pick out the value with ldap query:

'(objectClass=groupPolicyContainer)' 
 ([adsisearcher]'(objectCategory=groupPolicyContainer)').FindAll() | ForEach-Object {
      New-Object -TypeName PSCustomObject -Property @{
      abc = $_.Properties.gPCMachineExtensionNames -join ''
      }
  }

But the result is emtpy. I can only query other attributes like name, cn, USNCreated, displayname,.. There are displayed correctly. Why it's not possible to return the value of the attribute gPCMachineExtensionNames?

Can I make another LDAP Query or is there another method to query or modify the attribute on Windows Server 2008 R2?

Thanks for your support!


Solution

  • Check the case of the name:

    $allGPOs = ([adsisearcher]'(objectCategory=groupPolicyContainer)').FindAll()
    
    # this returns nothing
    $allGPOs | % { $_.Properties.gPCmachineExtensionNames }
    
    # this returns what you expect
    $allGPOs | % { $_.Properties.gpcmachineextensionnames }
    
    $allGPOs | ForEach-Object {
        New-Object -TypeName PSCustomObject -Property @{
            abc = $_.Properties.gpcmachineextensionnames -join ''
        }
    }
    

    I'm making an assumption here that as $allGPOs.GetType() is SearchResultCollection, and $allGPOs[0].Properties.GetType() is SearchResultCollection, they behave slightly different than "regular" name/value pairs.