GPO Report for Active Directory | PowerShell Script | Review and Document Group Policies | HTML Report + CSV | German

A PowerShell script that lists all group policies in a domain, including their content and links, and checks them against 26 criteria – orphaned links, differing versions between domain controllers, policies that are not in effect, edit rights for non-administrators, and empty or forgotten policies. The result is a clear HTML report in German with an explanation and recommendation for each finding.

THIS IS INCLUDED
• PowerShell script GPO-Bericht.ps1 (open source code, commented)
• Instructions as PDF
• Sample report of a test domain (HTML)

THE SCRIPT ONLY WORKS IN READING TIME
It does not change any group policy, any links, or anything in Active Directory or SYSVOL, and it does not transfer any data. Anything that cannot be read is shown in the report as a finding and is never implicitly considered OK.

THE 26 CHECKPOINTS
• Errors: Links to non-existent group policies; Status in directory and SYSVOL differs (per domain controller); Group policies without a readable folder in SYSVOL; Folder in SYSVOL without an associated group policy; Disabled portion contains settings; No one is allowed to apply the policy (security filtering empty); User policy for computer not readable (MS16-072); Reference to missing WMI filter
• Security: Any user can edit the policy; non-administrators can edit the policy; passwords in group policies
• Cleanup: Unlinked Group Policies; Empty Group Policies; Completely disabled Group Policies; Disabled links; Links to empty organizational units; Settings do not match the content of the organizational unit; Multiple Group Policies with the same name; Unused WMI filters; Password policy in an unexpected location; Default Domain Policy contains additional settings
• Setup (for your information): Forced links; organizational units with inheritance disabled; group policies with WMI filters; policies with "Deny" applied; loopback processing enabled

REQUIREMENTS
• Windows PowerShell 5.1 and the Active Directory module (present on domain controllers, otherwise RSAT)
• A normal domain account is sufficient; for a full report, start as administrator.
• Tested with Windows PowerShell 5.1 on Windows Server 2025 in a test domain with two domain controllers, as an administrator and as a regular user; each checkpoint was triggered with a simulated error. Not tested: older Windows servers, forests with multiple domains, and environments with hundreds of policies.

FOR WHOM
Administrators and IT service providers who clean up, document, or take over a domain within an existing group policy landscape.

GOOD TO KNOW
• Digital download (ZIP and PDF) – no physical product will be shipped
• Language of script output, report and instructions: German
• The report identifies anomalies based on fixed rules; it does not replace security audits or monitoring.
• Use within your own company or for your own customers; no resale
• Use at your own risk

Note: Content and structure originate from the seller; AI tools were used to assist in its development. All content has been professionally reviewed by the seller.