GPMgmt.GPM (Group policy) and local computer policy

[lupidus]

Is it possible to use GPMgmt.GPM to make changes to the local computer policy or is this object limited to domain level policies?

If it is possible to modify local policy using this method, does anyone have sample code?

Here's sample code of what I've found. As you can see it explicitly requires the domain level GPO name and domain name (which aren't relevant for local policy):

strGPO = "" ' gpo name
strDomain = "" ' a.com

boolUserEnable = False
boolCompEnable = True

set objGPM = CreateObject("GPMgmt.GPM")
set objGPMConstants = objGPM.GetConstants()

' init the domain object
set objGPMDomain = objGPM.GetDomain(strDomain, "", objGPMConstants.UseAnyDC)


'find the specified GPO
set objGPMSearchCriteria = objGPM.CreateSearchCriteria
objGPMSearchCriteria.Add objGPMConstants.SearchPropertyGPODisplayName, objGPMConstants.SearchOpEquals, cstr(strGPO)
set objGPOList = objGPMDomain.SearchGPOs(objGPMSearchCriteria)
if objGPOList.Count = 0 then
	wscript.echo "Did not find any GPO: " & strGPO
	wscript.echo "Exiting."
	wscript.quit
elseif objGPOList.Count > 1 then
	wscript.echo "Fond more than one matching GPO. Count: " & objGPOList.Count
	wscript.echo "Exiting."
	wscript.quit
else
	wscript.echo "Found GPO: " & objGPOList.Item(1).DisplayName
end if

'objGPOList.Item(1).SetUserEnabled boolUserEnable
'wscript.echo "User settings: " & boolUserEnable
'objGPOList.Item(1).SetComputerEnabled boolCompEnable
'wscript.echo "Computer Settings: " & boolCompEnable

 

[markdmac]

You can export the security database on another PC that has been configured the way you want and can then script the importing of that database using secedit /configure.

I hope you find this post helpful.

Regards,

Mark