0

I'm trying to automate the creation of scheduled tasks within my domain without the use of group policy management gui/mmc.exe, and I am extremely close. I am running Windows Server 2019 Datacenter. I am manually creating a completely valid XML file at \\$domain\sysvol\$domain\policies\$policy_guid\preferences\machine\scheduledtasks\scheduledtasks.xml, it's within a proper GPO, and the GPO is linked to the domain, but here is the kicker; it doesn't show up within the GPO view unless I edit it. The .xml file will be created, but it won't show up within the GPO in mmc.exe unless I manually open the GPO, right click->edit -> go to the schedule task location within the editor, and then it will show up in the editor, but I have to open the properties of the scheduled task (Which all of the properties populate correctly) and close it. Once I do that, the scheduled task will then populate within the GPO upon refresh. What is the GPO editor doing behind the scenes that I am not? I decided to use Procmon.exe to see if I could catch it doing something, but the only thing that seems plausible are a bunch of calls to the IPC$ share, and I'm not sure how to analyze it from there.

After that, I started using PowerShell's Backup-GPO and Import-GPO to see if I could recreate a GPO. I created a backup of a GPO that had both a valid schedule task that was made manually, and one of my automated ones that wasn't showing up within mmc.exe. When I imported the GPO and remade it from the backup directory, it came back exactly how it was initially with one functional Scheduled Task item and one that wasn't working. Since the the import was done from a single directory that was a copy of the GPO with some extra backup files, I dug through the directory to try to see how the Import-GPO could possible create a Scheduled Task item correct, as the difference had to be within that directory. Unless it was making it from GPOReport that was stored within the directory, I couldn't find an answer. The only thing that seemed fishy was a bunch of references to a "adm" directory under the policy's directory which the "adm" directory doesn't seem to exist.

So I'm finally about to give up. I've tried to do everything else I could think of to get my scheduled tasks within a .xml file to show up in mmc.exe and populate on the hosts on the domain (Yes there is a direct correlation between it showing up or not in MMC and it being updated to the hosts). I've variations of editing the GPO and registry key values with Powershell, to restarting the Active Directory services on the DC. The only thing I can logically think of is that the settings and properties editor within MMC updates a flag, file, or key somewhere that then tells MMC that there is new data that is part of the GPO when you refresh MMC.

Even if you don't have a solution, more ideas to try would be welcome.

1 Answer 1

0

I managed to do something similar to create new drive mapping GPOs using a bit of XML wrangling, so I imagine that could be adapted to what you're doing here. In my case I created a template GPO, then copy that to the new name, set the required permissions, retrieve the GUID for the policy I've just created and then with that find and edit the XML that has just been created to my new settings. The complete code block is :

# Copy an existing drive mapping GPO, set permissions and link it to the OU
$null=Copy-GPO -SourceName "TEMPLATE - Map network drive" -TargetName "$targetGPOname"
"Map network drive GPO copied"
$null=Set-GPPermissions -Name "$targetGPOname" -PermissionLevel GpoApply -TargetName "$targetUserGroup" -TargetType Group
"Map network drive GPO permission 1 done (add $targetUserGroup)"

$null=Set-GPPermissions -Name "$targetGPOname" -PermissionLevel GpoRead -TargetName "$domain\Domain Computers" -TargetType Group
"Map network drive GPO permission 2 done (add $domain\Domain Computers)"

$null=Set-GPPermissions -Name "$targetGPOname" -PermissionLevel None -TargetName "Authenticated Users" -TargetType Group
"Map network drive GPO permission 3 done (remove authenticated users)"
$null=New-GPLink -Name "$targetGPOname" -Target "OU=myOU,DC=mydomain,DC=co,DC=uk" -LinkEnabled Yes
"New Map network drive GPO linked to target OU"
# Find the ID of the newly created GPO
$guid = get-gpo -name "$targetGPOname"
$policy_guid=$guid.Id.ToString()

# Read the drives.xml file containing the newly created GPP settings, amend them with the correct COMPAN details and update it
$drivesxml=new-object XML
$drivesxml.load("\\$domain\sysvol\$domain\policies\$policy_guid\preferences\{$policy_guid}\User\Preferences\Drives\drives.xml")
$path=$drivesxml.SelectNodes('/Drives/Drive/Properties')
$path[0].path = $path[0].path -replace 'oldString$',$newString
$path[0].label = $path[0].label -replace '^oldstring',$newString
$drivesxml.save("\\$domain\sysvol\$domain\policies\$policy_guid\preferences\{$policy_guid}\User\Preferences\Drives\drives.xml")
"Group Policy $targetGPOname amended for new path"

so if the setting or settings you're changing withing the scheduled task can be similarly found and replaced to do what you need, then you may be able to adapt this to your needs.

Alternatively with your existing setup, you may find simply using the New-GPLink cmdlet above, or loading and then saving off the XML as shown above is enough to get it to show up properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.