HGPM

0.1.10-alpha

Resources/Configuration.psd1

# Configuration of HGPM, as shipped with the module.
#
# To change it, do not edit this file (an update of the module replaces it): the configuration
# of the domain holds the keys it changes, for every console of the domain, in the SYSVOL of its
# domain controllers: SYSVOL\<domain>\PSGPOTools\Configuration.psd1. Only the administrators
# of the domain can write it (the Settings window of the console, or the file itself); there is
# no configuration of the user. Get-PSGPOConfiguration shows where it is and the values in use.
# The files are read as data (Import-PowerShellDataFile): they run no code.
@{
    # A new GPO, created from the Group Policy Management view.
    NewGpo = @{
        # Name proposed for a new GPO.
        DefaultName = 'New Group Policy Object'

        # GPO status of a new GPO: Enabled, ComputerOnly (user settings disabled) or UserOnly
        # (computer settings disabled).
        Status = 'Enabled'

        # Security filtering groups: a group whose members alone apply the GPO, and a group whose
        # members never apply it.
        SecurityFilteringGroups = @{
            # "Create the security filtering groups" checked when the form opens.
            Create = $false

            # Where the groups are created: a distinguished name (OU=GPO,OU=Groups,DC=contoso,DC=com),
            # or a path below the domain (OU=GPO,OU=Groups). Empty: the users container (CN=Users).
            Container = ''

            # Names of the groups: the prefix, then the name of the GPO.
            ApplyPrefix = 'APPLY_'
            DenyPrefix = 'DENY_'

            # Scope of the security groups: Global, DomainLocal or Universal.
            Scope = 'Global'

            # Descriptions of the groups; {0} is the name of the GPO.
            ApplyDescription = 'Members apply the GPO {0}'
            DenyDescription = 'Members do not apply the GPO {0}'
        }
    }

    # Backups of the GPOs (History tab, Backup-PSGPO).
    Backup = @{
        # Label of the approved versions: the newest backup with it is the reference the GPO is
        # compared to, to find what changed since (Get-PSGPODrift, History tab).
        ApprovedLabel = 'Approved'

        # Label of the templates: a backup with it is proposed as the start of a new GPO (its
        # settings copied into it), whatever domain it comes from.
        TemplateLabel = 'Template'
    }

    # Audit log: each change the consoles and the commands make in the domain, one line (when, who,
    # from which computer, what, on which GPO or container), never rewritten; Get-PSGPOAuditLog
    # reads it.
    Audit = @{
        # Folder of the log, the same for every console of the domain: a share the administrators
        # of the GPOs write (\\server\gpo-audit). Empty: the folder Audit of the backups of the
        # account, which only its console sees.
        Path = ''
    }

    # The Group Policy Management view of the console.
    View = @{
        # Every account sees the whole domain, as GPMC: what it does not manage (its
        # delegations) is greyed, read only. $false: it sees only what it manages, and an account
        # without delegation sees nothing.
        ShowUnmanaged = $true
    }

    # Approval workflow: the GPOs the creators make wait for the approval of an approver. The
    # rights are those of the domain: the creators get the right to create GPOs (Initialize-
    # PSGPOWorkflow), not Group Policy Creator Owners; a GPO they create applies to nobody until
    # it is approved; the approval gives it to the owner of the approved GPOs and sets what the
    # creators may still do with it.
    Workflow = @{
        # The approval workflow is used.
        Enabled = $false

        # Groups of the approvers (Tier 0), separated by commas: names of the domain.
        Approvers = 'Domain Admins'

        # Groups of the creators (Tier 1), separated by commas: they create GPOs that wait for
        # an approval, and edit them until then.
        Creators = ''

        # Owner of the approved GPOs: a group of the approvers.
        ApprovedOwner = 'Domain Admins'

        # What the approval proposes for the creators: ReadOnly (they cannot change the GPO
        # anymore) or EditSettings (they still edit its settings; each change needs a new
        # approval).
        CreatorRights = 'ReadOnly'
    }
}