Group Policy Management Handbook

New GPO, not linked yet

New-GPO -Name "WKS - Baseline - Security" -Comment "Corporate workstation security baseline v3"

Create unlinked first, configure and test, then link; never author directly against a live production link.

Link a GPO to an OU

New-GPLink -Name "WKS - Baseline - Security" `
  -Target "OU=Pilot,OU=Workstations,DC=corp,DC=local" `
  -LinkEnabled Yes -Order 1

-Order 1 gives it top precedence on that OU (processed last = wins).

Set a registry-backed policy value

Set-GPRegistryValue -Name "WKS - Baseline - Security" `
  -Key "HKLM\Software\Policies\Microsoft\Windows Defender" `
  -ValueName "DisableAntiSpyware" -Type DWord -Value 0

For anything not covered by a cmdlet, this is the general-purpose escape hatch into any ADMX-backed key.

Block inheritance on an OU

Set-GPInheritance -Target "OU=Lab,DC=corp,DC=local" -IsBlocked Yes

Enforce a GPO link

Set-GPLink -Name "WKS - Baseline - Security" `
  -Target "DC=corp,DC=local" -Enforced Yes

Use sparingly; enforced baseline GPOs at the domain root are appropriate; enforcing dozens of GPOs makes troubleshooting precedence painful.

Restrict a GPO to a pilot group

Set-GPPermission -Name "WKS - Baseline - Security" `
  -TargetName "Authenticated Users" -TargetType Group -PermissionLevel None

Set-GPPermission -Name "WKS - Baseline - Security" `
  -TargetName "GPO-Pilot-Workstations" -TargetType Group `
  -PermissionLevel GpoApply

Remove Authenticated Users' Apply right, then grant Apply only to your pilot security group. This is how you pilot a GPO inside a production OU without moving computer objects.

Connect to Graph with Intune scopes

Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All", `
  "DeviceManagementManagedDevices.ReadWrite.All", `
  "Group.Read.All"

List existing configuration profiles

Get-MgDeviceManagementConfigurationPolicy | Select-Object Name, Id, CreatedDateTime

Assign a profile to a dynamic group

New-MgDeviceManagementConfigurationPolicyAssignment `
  -DeviceManagementConfigurationPolicyId $policyId `
  -Target @{ "@odata.type" = "#microsoft.graph.groupAssignmentTarget"; groupId = $groupId }

Dynamic device group rule example: Windows 11 laptops

(device.deviceOSType -eq "Windows") and
(device.deviceOSVersion -startsWith "10.0.22") and
(device.deviceModel -contains "Latitude")

Set in Entra ID > Groups > New Group > Membership type: Dynamic Device.

Assignment filters (narrow an assignment further)

(device.manufacturer -eq "Dell") and (device.enrollmentProfileName -eq "Corp-Autopilot")

Filters apply on top of group assignment without needing a new group per hardware combination; the Intune equivalent of a WMI filter.

Minimal compliance policy checklist

• Require BitLocker / device encryption
• Require a minimum OS version
• Require Defender / Endpoint Protection to be active
• Mark non-compliant after grace period (typically 0–3 days)

Force a GPO refresh on the local machine

gpupdate /force
gpupdate /target:computer /force
gpupdate /target:user /force

Force refresh across many machines remotely

Invoke-GPUpdate -Computer "PC-0231" -Force -RandomDelayInMinutes 0

Get-ADComputer -Filter * -SearchBase "OU=Pilot,OU=Workstations,DC=corp,DC=local" |
  ForEach-Object { Invoke-GPUpdate -Computer $_.Name -Force -RandomDelayInMinutes 10 }

Add a random delay across a large batch to avoid hammering domain controllers simultaneously.

Force an Intune device sync

Settings app > Accounts > Access work or school >
  Connected to [tenant] > Info > Sync

Or via Graph for a device you manage centrally:

Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $deviceId

Restart the Intune Management Extension service

Restart-Service -Name IntuneManagementExtension -Force

Use when Win32 app or script deployments are stuck "Pending"; this restarts the local sync agent without a full reboot.

Check hybrid join / Entra registration state

dsregcmd /status

Look at AzureAdJoined, DomainJoined, and AzureAdPrt; a device that shows AzureAdJoined: NO will never receive Intune policy no matter how correctly the profile is assigned.

New-device provisioning checklist

• Hardware hash registered in Autopilot before first boot
• Deployment profile assigned to the Autopilot device group
• ESP (Enrollment Status Page) blocking on required apps/policies configured deliberately, not left default
• Ring assignment confirmed before shipping to end user

Summary of applied GPOs

gpresult /r

Fast pass/fail view: which GPOs applied, which were filtered out, and why.

Full HTML resultant set of policy report

gpresult /h C:\Temp\gpresult.html /f

Attach this to change tickets; shows every setting, its winning GPO, and precedence order.

Resultant Set of Policy console

rsop.msc

Interactive tree view of every applied setting; best for spot-checking a single machine during a live troubleshooting session.

Group Policy Results Wizard (remote, no agent needed)

In GPMC: right-click Group Policy Results > run wizard > target remote computer/user. Requires WMI + RPC reachability to the target; same requirement as Invoke-GPUpdate.

Get RSoP as a queryable object

Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Temp\rsop.html
Get-GPOReport -All -ReportType Html -Path C:\Temp\all-gpos.html

SYSVOL / replication health check

dcdiag /test:sysvolcheck /test:advertising
repadmin /replsummary

A GPO that "isn't applying anywhere" is sometimes a SYSVOL replication failure, not a policy authoring problem; check this before re-editing settings.

Deployment status by device

Intune admin center > Devices > Configuration > select profile > Device status tab. Shows Succeeded / Error / Conflict / Not applicable per device with error codes.

Find setting conflicts across profiles

Devices > Configuration > select profile > Per-setting status; surfaces exactly which other profile is fighting for the same CSP path.

Pull device configuration status via Graph

Get-MgDeviceManagementDeviceConfigurationDeviceStatus `
  -DeviceConfigurationId $configId | `
  Select-Object DeviceDisplayName, Status, LastReportedDateTime

MDM Diagnostic Report on the endpoint

Settings > Accounts > Access work or school >
  Connected to [tenant] > Info >
  Create report

Generates a local HTML/XML report of every applied CSP and its value; the Intune equivalent of gpresult /h.

Scheduled full backup of every GPO

Backup-GPO -All -Path "\\fileserver\GPO-Backups\$(Get-Date -Format yyyy-MM-dd)"

Run as a daily scheduled task on a management server; cheap insurance, keep 30–90 days of history.

Restore a GPO from backup

Restore-GPO -Name "WKS - Baseline - Security" `
  -Path "\\fileserver\GPO-Backups\2026-07-01"

Copy a GPO between domains (with migration table)

Copy-GPO -SourceName "WKS - Baseline - Security" `
  -SourceDomain "corp.local" -TargetDomain "contoso.local" `
  -MigrationTable "C:\GPO\domain-migration.migtable"

Migration tables remap domain-specific SIDs/UNC paths so security filtering and drive maps translate correctly to the target domain.

Import settings into an existing (unlinked) GPO

Import-GPO -BackupId $backupGuid -TargetName "WKS - Baseline - Security" `
  -Path "\\fileserver\GPO-Backups\2026-07-01"

Recommended GPO naming pattern

[Scope] - [Category] - [Purpose] - [vN]
Example: WKS - Security - BitLocker Baseline - v3
Example: SRV - Network - Firewall Rules - v1

Consistent prefixes make Get-GPOReport -All output sortable and searchable at a glance.

Find unlinked, orphaned GPOs

Get-GPO -All | Where-Object { ($_ | Get-GPOReport -ReportType Xml) -notmatch "<LinksTo>" }

Unlinked GPOs accumulate silently; audit quarterly and remove or archive anything with no active link and no owner.

Full clean re-apply of Group Policy

gpupdate /force /boot

Forces both computer and user policy and schedules a reboot if a policy requires it (e.g. some security settings).

Clear the local Group Policy cache (last resort)

Stop-Service gpsvc -Force
Remove-Item "C:\Windows\System32\GroupPolicy" -Recurse -Force
Remove-Item "C:\Windows\System32\GroupPolicyUsers" -Recurse -Force
Start-Service gpsvc
gpupdate /force

Repair a corrupted WMI repository (blocks WMI-filtered GPOs)

winmgmt /verifyrepository
winmgmt /salvagerepository

Check time sync (Kerberos fails >5 min skew, silently breaks GPO pull)

w32tm /query /status
w32tm /resync /force

Confirm domain controller reachability

nltest /dsgetdc:corp.local
Test-NetConnection -ComputerName dc01.corp.local -Port 389

Force MDM enrollment re-sync from PowerShell

Get-ScheduledTask | Where-Object {$_.TaskName -like "*EnterpriseMgmt*Schedule*"} | Start-ScheduledTask

Triggers the same sync scheduled task the Settings app "Sync" button calls; useful for scripting bulk syncs via RMM/SCCM.

Full MDM re-enrollment (device stuck / policy frozen)

dsregcmd /leave
Restart-Computer
# Then sign back in to trigger auto-enrollment, or:
deviceenroller.exe /c /AutoEnrollMDM

Check SYSVOL replication (DFSR) health across DCs

dfsrdiag replicationstate
Get-DfsrBacklog -GroupName "Domain System Volume" -FolderName "SYSVOL Share" -SourceComputerName DC01 -DestinationComputerName DC02