PowerShell Logo Small

Get-GPInheritance



This is the built-in help made by Microsoft for the command 'Get-GPInheritance', in PowerShell version 5 - as retrieved from Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell help files on 2016-06-23.

For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.

SYNOPSIS

Retrieves Group Policy inheritance information for a specified domain or OU.

SYNTAX


Get-GPInheritance [-Target] <String> [-Domain <String>] [-Server <String>] [<CommonParameters>]



Search powershellhelp.space

DESCRIPTION


The Get-GPInheritance cmdlet returns information about Group Policy inheritance for a specified domain or OU.


This information includes the following:

-- A list of GPOs that are linked directly to the location (the GpoLinks property).

-- A list of GPOs that are applied to the location when Group Policy is processed on a client (the InheritedGpoLinks property).

-- Whether inheritance is blocked for the location (the GpoInheritanceBlocked property).


Note: The InheritedGpoLinks property contains a list of the GPOs are applied to the OU or domain when Group Policy is processed on a client;. The GPOs are listed according
to the order of precedence with which they are applied. This list includes (in the following order):

-- Inherited GPOs that are linked, enabled, and enforced at higher levels of the Group Policy hierarchy (for example, a site).

-- GPOs that are linked and enabled directly at the specified location.

-- If inheritance is not blocked for the specified location, inherited GPOs that are linked and enabled -- but not enforced -- at higher levels of the Group Policy hierarchy.



<

RELATED LINKS

Online Version: http://go.microsoft.com/fwlink/?linkid=287714
Set-GPInheritance

REMARKS

<

Examples


-------------------------- EXAMPLE 1 --------------------------

C:\PS>Get-GPInheritance -target "ou=MyOU,dc=contoso,dc=com"

ContainerName : myou

ContainerType : OU

Path : ou=myou,dc=contoso,dc=com

GpoInheritanceBlocked : No

GpoLinks : {TestGPO-0, TestGPO-1, TestGPO-2, TestGPO-3...}

InheritedGpoLinks : {TestGPO-2, TestGPO-3, Default Domain Policy}



Description

-----------

This command retrieves Group Policy inheritance information for the OU named 'MyOU' in the contoso.com domain.

The GpoLinks property contains a list of all the GPOs that are linked directly to the GPO, whether their links are enabled or not.

The InheritedGpoLinks property contains a list of all the GPOs that are applied when Group Policy is processed on the client. TestGPO-2 and TestGPO-3 appear in this list
because their links are enabled.

The "Default Domain Policy" GPO is inherited from the contoso.com domain. If inheritance is blocked, it does not appear in the InheritedGpoLinks property unless its link is
enforced (at the domain). If its link is enforced, it appears first in the list.




-------------------------- EXAMPLE 2 --------------------------

C:\PS>Get-GPInheritance -Target "dc=contoso,dc=com" -Domain contoso.com -Server DomainController1

Name : contoso.com

ContainerType : Domain

Path : dc=contoso,dc=com

GpoInheritanceBlocked : No

GpoLinks : {Default Domain Policy}

InheritedGpoLinks : {Default Domain Policy}



Description

-----------

This command retrieves Group Policy inheritance information for the contoso.com domain. The domain controller with the host name DomainController1 is contacted to complete
the operation.

Note: The domain does not have to be explicitly specified (by using the Domain parameter) in this example. If the domain of the user that is running the session (or, for
startup and shutdown scripts, the computer) is the same as the target domain, or a trust exists between it and the target domain, you do not have to specify the Domain
parameter.




-------------------------- EXAMPLE 3 --------------------------

C:\PS>(Get-GPInheritance -Target "ou=myou,dc=contoso,dc=com").GpoLinks | foreach-object { Get-GPO -Name ($_.DisplayName)}

DisplayName : TestGPO-3

DomainName : contoso.com

Owner : CONTOSO\Domain Admins

Id : d02126d4-82e8-4e87-b4a0-2d44b6891411

GpoStatus : AllSettingsEnabled

Description :

CreationTime : 2/27/2009 2:59:51 PM

ModificationTime : 2/27/2009 4:00:44 PM

UserVersion : AD Version: 13, SysVol Version: 13

ComputerVersion : AD Version: 0, SysVol Version: 0

WmiFilter :



DisplayName : TestGPO-2

DomainName : contoso.com

Owner : CONTOSO\Domain Admins

Id : 375865b2-3b5f-480f-8f56-2a994ea6e725

GpoStatus : AllSettingsEnabled

Description :

CreationTime : 2/26/2009 11:28:08 PM

ModificationTime : 3/1/2009 11:07:30 AM

UserVersion : AD Version: 0, SysVol Version: 0

ComputerVersion : AD Version: 1, SysVol Version: 1

WmiFilter :



Description

-----------

This command evaluates the SOM object (Microsoft.GroupPolicy.SOM) returned by Get-GPInheritance and returns the GPOs that are linked to the "MyOU" organizational unit. You
can use this command to set properties of the GPOs by piping its output into other cmdlets. For example, you can pipe the output to the Set-GPPermissions command to delegate
permissions to administrators of the OU for each of the GPOs linked to the OU.

The GpoLinks property of the SOM object contains a list of all the GPO links for the OU. Each object in this list is of type Microsoft.GroupPolicy.GpoLink. The following
shows one such object:

GpoId : d02126d4-82e8-4e87-b4a0-2d44b6891411

DisplayName : TestGPO-3

Enabled : True

Enforced : False

Target : ou=myou,dc=contoso,dc=com

Order : 1

The collection is piped into a foreach-object command, which retrieves each GPO by using the DisplayName property of the GpoLink object.