HGPM

0.1.21-alpha

Resources/Configuration.psd1

                                # Configuration of HGPM, as shipped with the module.

#

# To change it, do not edit this file (an update of the module replaces it): the configuration

# of the domain holds the keys it changes, for every console of the domain, in the SYSVOL of its

# domain controllers: SYSVOL\<domain>\PSGPOTools\Configuration.psd1. Only the administrators

# of the domain can write it (the Settings window of the console, or the file itself); there is

# no configuration of the user. Get-PSGPOConfiguration shows where it is and the values in use.

# The files are read as data (Import-PowerShellDataFile): they run no code.

@{

    # A new GPO, created from the Group Policy Management view.

    NewGpo = @{

        # Name proposed for a new GPO.

        DefaultName = 'New Group Policy Object'

        # GPO status of a new GPO: Enabled, ComputerOnly (user settings disabled) or UserOnly

        # (computer settings disabled).

        Status = 'Enabled'

        # Security filtering groups: a group whose members alone apply the GPO, and a group whose

        # members never apply it.

        SecurityFilteringGroups = @{

            # "Create the security filtering groups" checked when the form opens.

            Create = $false

            # Where the groups are created: a distinguished name (OU=GPO,OU=Groups,DC=contoso,DC=com),

            # or a path below the domain (OU=GPO,OU=Groups). Empty: the users container (CN=Users).

            Container = ''

            # Names of the groups: the prefix, then the name of the GPO.

            ApplyPrefix = 'APPLY_'

            DenyPrefix = 'DENY_'

            # Scope of the security groups: Global, DomainLocal or Universal.

            Scope = 'Global'

            # Descriptions of the groups; {0} is the name of the GPO.

            ApplyDescription = 'Members apply the GPO {0}'

            DenyDescription = 'Members do not apply the GPO {0}'

        }

    }

    # Backups of the GPOs (History tab, Backup-PSGPO).

    Backup = @{

        # Folder of the backups, the same for every console of the domain: a share of a file server

        # (\\server\gpo-backups), prepared once with Initialize-PSGPOBackupShare, for Tier 0 only

        # (the approvers of the workflow and the administrators of the domain). Empty: the folder

        # of the History tab of each account.

        Path = ''

        # Label of the approved versions: the newest backup with it is the reference the GPO is

        # compared to, to find what changed since (Get-PSGPODrift, History tab).

        ApprovedLabel = 'Approved'

        # Label of the templates: a backup with it is proposed as the start of a new GPO (its

        # settings copied into it), whatever domain it comes from.

        TemplateLabel = 'Template'

    }

    # Audit log: each change the consoles and the commands make in the domain, one line (when, who,

    # from which computer, what, on which GPO or container), appended only and chained to the

    # previous one; Get-PSGPOAuditLog reads and checks it.

    Audit = @{

        # Whether the changes are written to the audit log: yes by default.

        Enabled = $true

        # Folder of the log, the same for every console of the domain: a share of a file server

        # (\\server\gpo-audit), prepared once with Initialize-PSGPOAuditShare: a folder per tier,

        # each account adds its changes to its own file in the folder of its tier. Not SYSVOL: it

        # is copied to every domain controller. Empty: the folder Audit of the backups of the

        # account, which only its console sees.

        Path = ''

        # The tiers of the central log (Audit.Path): Tier 0 is the approvers of the workflow and

        # the administrators of the domain, who read every tier.

        Tiers = @{

            # Groups of Tier 1, separated by commas: they write in the folder Tier1 and read the

            # changes of their tier.

            Tier1 = ''

            # Groups of Tier 2, separated by commas: the folder Tier2.

            Tier2 = ''

        }

        # Groups that read every tier without writing (auditors), separated by commas.

        Readers = ''

        # Groups that run the retention of the central log (Invoke-PSGPOAuditRetention, planned):

        # they read every tier, delete the files of the old months and write the archives,

        # without being administrators of the domain. The group of a gMSA, separated by commas.

        Purgers = ''

        # Months the central log keeps: Invoke-PSGPOAuditRetention puts the older months in a .zip

        # of the folder Archive, then deletes their files. 0: everything is kept.

        RetentionMonths = 13

    }

    # The technical log of each console (the errors of LDAP, SYSVOL, samba-tool, smbclient, with

    # the command and its output), in the data of the user, and the log of the system.

    Log = @{

        # What the technical log keeps: Error, Warning, Information (the commands that fail) or

        # Verbose (every command).

        Level = 'Warning'

        # Days the files of the technical log are kept.

        RetentionDays = 30

        # The changes of the audit log and the errors sent to the log of the system: the Windows

        # event log (source HGPM, Register-PSGPOEventSource) or syslog/journald.

        SystemLog = $true

    }

    # The consoles that use the configuration of the domain.

    Console = @{

        # Version of HGPM a console needs at least (0.1.14): an older console does not use the

        # configuration, and the accounts that are not administrators of the domain create no

        # GPO with it. Set it once every console is updated, after a setting a newer version

        # added. Empty: every version.

        MinimumVersion = ''

    }

    # The Group Policy Management view of the console.

    View = @{

        # Every account sees the whole domain, as GPMC: what it does not manage (its

        # delegations) is greyed, read only. $false: it sees only what it manages, and an account

        # without delegation sees nothing.

        ShowUnmanaged = $true

    }

    # Approval workflow: the GPOs the creators make wait for the approval of an approver. The

    # rights are those of the domain: the creators get the right to create GPOs (Initialize-

    # PSGPOWorkflow), not Group Policy Creator Owners; a GPO they create applies to nobody until

    # it is approved; the approval gives it to the owner of the approved GPOs and sets what the

    # creators may still do with it.

    Workflow = @{

        # The approval workflow is used.

        Enabled = $false

        # Groups of the approvers (Tier 0), separated by commas: names of the domain.

        Approvers = 'Domain Admins'

        # Groups of the creators (Tier 1), separated by commas: they create GPOs that wait for

        # an approval, and edit them until then.

        Creators = ''

        # Owner of the approved GPOs: a group of the approvers.

        ApprovedOwner = 'Domain Admins'

        # What the approval proposes for the creators: ReadOnly (they cannot change the GPO

        # anymore) or EditSettings (they still edit its settings; each change needs a new

        # approval).

        CreatorRights = 'ReadOnly'

    }

}