Use Active Directory PowerShell to get Group Policy Object links to a Site object using Get-GPInheritance cmdlet

If you've used the cmdlet Get-GPInheritance you may be surprised to find that the cmdlet doesn't allow you to target an Active Directory site to find the Group Policy objects linked to that site.

To do this you'll need to get the information manually from the gpLink attribute in Active Directory.

# Gets the Active Directory Group policy object links for the specified site name.
Function Get-GroupPolicySiteLinks
{

    [CmdletBinding()]
    param(
    
        [Parameter()]
        [System.String] $SiteName
    )
    process
    {
        
        $site = Get-ADReplicationSite -Identity $SiteName -Properties "gpLink";
        $groupPolicyLinks = [regex]::Matches($site.gpLink, "(?<=\[).+?(?=\])").Value;               [array]::Reverse($groupPolicyLinks);
        foreach ($groupPolicyLink in $groupPolicyLinks)
        {
            $gpoGuid = [regex]::Matches($groupPolicyLink, "(?<=\{).+?(?=\})").Value;
            $gpoOptions = $groupPolicyLink.Split(";")[1];
            $enabled = !(($gpoOptions -band 1) -eq 1);
            $enforced = ($gpoOptions -band 2) -eq 2;
            $gpo = Get-GPO -Guid $gpoGuid;
            Write-Host "GPO: $($gpo.DisplayName)";
            Write-Host " Enabled: $($enabled)";
            Write-Host " Enforced: $($enforced)";
            Write-Host "";
        }
    }
}

Get-ActiveDirectorySchemaAttributeDetails -SiteName "BranchOffice";

The PowerShell script is actually reading the gpLink attribute which again strangely uses a single value attribute to store multiple Group Policy object links.

The value is actually stored in the format "[distinguishedname;options][distinguishedname;options]".

So this value needs to be parsed by splitting each value using a regular expression.

Once this is complete we need to get the GUID of the Group Policy object - again this is because of a limitation in the Group Policy cmdlets - the Get-GPO cmdlet does not have the ability to take the distinguished name of a Group Policy object as a parameter.

The options are then read from the options value

BIT 1 = Group Policy Link Disabled

BIT 2 = Group Policy Link Enforced

 While you're here -
Why not check out our Active Directory Documentation Tool?