Solved

Advanced Group Policy Management Install

Posted on 2016-07-24
3
29 Views
Last Modified: 2016-07-25
I will be installing AGPM in our environment and account to the install guides online you need to install the application under a domain admin account but for the service account you can you a least prividge approach and added the account to the Backup Operators and GP Creator groups..

https://technet.microsoft.com/en-us/itpro/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40

If I am understand everything correctly one thing about the GP Creator GP is that is does not grant the user full access of already created GP but will on new GP's is this correct. If so with 100 GP's this will be a problem for me
0
Comment
Question by:compdigit44
  • 2
3 Comments
 
LVL 16

Accepted Solution

by:
Learnctx earned 500 total points
ID: 41726875
Yes, that is correct. In a least privilege setup the AGPM service account will not necessarily have rights to take control and manage any GPO. I am in the same position as you. With hundred's of GPO's, it can be painful. It is easy to script though; just iterate through the GPO's you want to give the AGPM account permissions for and add its group in with rights (you can also just add the account itself in instead of a group).

Set-GPPermissions -Name "GPO Name" -TargetName "Yourdomain\AGPMServiceGroup" -TargetType group -PermissionLevel GpoEditDeleteModifySecurity

Open in new window

0
 
LVL 19

Author Comment

by:compdigit44
ID: 41728573
Great Tip.. How can I dump all GP's my name to a file then have the script add the account needed to each GP?
0
 
LVL 16

Assisted Solution

by:Learnctx
Learnctx earned 500 total points
ID: 41728635
Obviously the usual disclaimer. Test all scripts in a test lab before you unleash them upon your production environment :)

Get-GPO -All | Select -expand displayname | out-file c:\temp\allgpos.txt

Open in new window

0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now