Get-GphGpHistory.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
#requires -Version 2.0
function Get-GphGpHistory
{
  <#
      .SYNOPSIS
      Retrieve the Group Policy History from the Registry.
 
      .DESCRIPTION
      The Group Policy Clients saves the last Group Policy run in Registry. This Cmdlet retrieves the keys
      and shows the respective Values
 
      .EXAMPLE
      Get-GPHistory -Scope Machine
      Shows the History for the Last time Computer-Policies were applied.
 
      .NOTES
      Author: Holger Voges
      Date: 2018-11-16
      Version: 1.0
  #>



  [CmdletBinding()]
  param(
    # User returns the User-History, Machine the Machine-History and All both
    [Parameter(Mandatory=$true)]
    [ValidateSet('User','Machine')]
    [String]$Scope,

    [switch]$detailed
  )  
  
  If ( $detailed )
  { 
    $HistoryProperties = 'DisplayName','GPOName','GPOLink','Extensions','Options','Version','Link','DSPath','FileSysPath'
  }
  Else
  {
    $HistoryProperties = 'DisplayName','GPOLink','Extensions','Options','Version','Link'
  }
  
  $GPHistoryKey = 'Software\Microsoft\Windows\CurrentVersion\Group Policy\History'
  Switch ( $PSBoundParameters.Item('Scope') )
  {
    User { $GPHistoryPath = Join-Path -Path 'Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER' -ChildPath $GPHistoryKey }
    Machine { $GPHistoryPath = Join-Path -Path 'Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE' -ChildPath $GPHistoryKey }    
  }

  $GPEs = Get-ChildItem -Path $GPHistoryPath
  foreach ( $GPExtension in $GPEs )
  {
    $PolicyList = Get-ChildItem -path $GPExtension.PSPath
    Foreach ( $policy in ( $PolicyList ) )
    {
      $GpoHistoryProperties = @{}

      Foreach ( $Property in ( $HistoryProperties ))       
      {
        Switch ( $property )
        {
          'lParam' {break}
          'Extensions' { $ExtensionList = (( Get-ItemProperty -Path $policy.PSPath -Name $_ ).$_) -split "(\[.+?\])" | Where-Object { $_ } 
                         $GpoHistoryProperties[$_] = $ExtensionList -join "`n" ; break }                 
          Default { $GpoHistoryProperties[$_] = (( Get-ItemProperty -Path $policy.PSPath -Name $_ ).$_ )}
        }
      }
      New-Object -TypeName PsCustomObject -Property $GpoHistoryProperties
    }
  }
}