asked on

Windows Group Policy Security filtering remove authenticated users

Hello,
Looking for an alternative to this

set-gppermissions -Name $Name -TargetName $TargetName -TargetType $TargetType -PermissionLevel $PermissionLevel -Domain $Domain -ErrorAction Stop

Open in new window

Setting the permissionLevel to none is generating a prompt for confirmation which causes issues with automation

Any help much appreciated

arnold

Could you provide what it is you are trying to do versus posting something that needs to be interpreted to what you are trying to do?

Mauro Cazabonnet

ASKER

Need to remove authenticated users from group policy security filtering

arnold

are you sure the prompt is not a UAC rights elevation prompt for alterations you are making?
try running cmd as administrator, then run powershell in the elevated command window....

Mauro Cazabonnet

ASKER

group policy cmdlet set-gppermissions is generating a prompt Y(yes) S(Suspend) or N(no) when permissionlevel is set to none
Not a UAC thing

oBdA

Set-GPPermission -Name $Name -TargetName $TargetName -TargetType $TargetType -PermissionLevel $PermissionLevel -Domain $Domain -ErrorAction Stop -Confirm:$false

Open in new window

ASKER CERTIFIED SOLUTION

Mauro Cazabonnet

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

McKnife

Just interested: on what server OS is -confirm:$false not working?

Mauro Cazabonnet

ASKER

Closing......

Mauro Cazabonnet

ASKER

It is Windows Server 2012 R2 Standard with PS 5.0

McKnife

Ok. I have a theory: the patch that "broke" this is trying to prevent that you do this for a simple reason: security filtering on user policies will not work anymore unless we still assign read permissions to authenticated users (or to the group domain computers), since MS has changed the way that user policies are processed. That would mean, you are modifying a user policy - are you? If so, don't remove read access for "authenticated users", just remove the "apply GPO" privilege.

Mauro Cazabonnet

ASKER

McKnife sorry for the delayed response
I'll review this week and see how it goes
I'll keep ya posted

M