New-DummyComputerURAGPO

New-DummyComputerURAGPO

Scaffolds the on-disk folder and XML structure of a GPO backup, ready to be imported with Import-GPO or GPMC. Intended as a starting point for building tier-specific User Rights Assignment (URA) GPOs.

Table of Content

• Version Changes
• Background
• What the Function Creates
• What the Function Does Not Do
• Parameters
• Examples
• Builtin Help

Version Changes

1.0.0.0

• First version published on GitHub

Background

In a Microsoft-style Active Directory tiering model, the ability to log on to a computer in each tier has to be tightly controlled via User Rights Assignment (URA), typically the "Allow log on locally", "Log on as a batch job", "Log on as a service", and the matching "Deny log on ..." rights, plus interactive, RDP, and network logon rights. Getting these right across Tier 0, Tier 1, Tier 2 is one of the load-bearing technical controls of the whole model, it is what prevents a compromised Tier 2 workstation from exposing Tier 0 credentials.

The practical problem is that building a URA-only GPO from scratch is awkward:

• The Group Policy Management Console (GPMC) is happy to edit an existing GPO, but offers no clean "new GPO from template" flow for this use case.
• There is no builtin PowerShell cmdlet that creates a new GPO backup folder structure from nothing. Backup-GPO requires an existing GPO to back up, and Import-GPO requires a backup folder to import from.

This function solves the chicken-and-egg problem by generating a minimal but valid GPO backup folder on disk. You then either import the empty skeleton and edit it in GPMC, or pre-populate GptTmpl.inf with the URA entries you want, and import a ready-made GPO in one step.

The "Dummy" in the name refers to the placeholder values baked into the backup metadata (GPO GUID, domain name, domain controller, SIDs). GPMC and Import-GPO resolve these to your actual domain during import. The "ComputerURA" reflects that the scaffold only contains the Machine-side structure needed for URA settings, no User-side configuration.

What the Function Creates

Under <Path>\DummyGPO\{12345678-1234-1234-1234-123456789012}\:

├── Backup.xml                              # GPO backup manifest (placeholder metadata)
├── bkupInfo.xml                            # Backup instance metadata
└── DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\
    └── GptTmpl.inf                         # Security template, empty, edit to add URA entries

The structure mirrors what Backup-GPO produces for a real GPO, so Import-GPO treats it identically.

What the Function Does Not Do

• It does not pre-seed any URA entries. The generated GptTmpl.inf contains only the [Unicode] and [Version] headers, no [Privilege Rights] section. You add that yourself (see Examples).
• It does not create a GPO in the domain. The output is a backup folder on the local filesystem, you still need Import-GPO (or GPMC's Manage Backups, Restore) to materialise it as a real GPO.
• It does not overwrite existing files. If the target folder or any of the three files already exists, that item is left alone (a -Verbose message is written).

Parameters

Parameter	Mandatory	Default	Notes
Path	No	(Get-Location).Path	Parent folder to create DummyGPO\{...}\ under. Must already exist.

Examples

Scaffold under the current directory, then import via GPMC or PowerShell:

    PS C:\> New-DummyComputerURAGPO -Verbose
    VERBOSE: Creating GPO directory structure
    VERBOSE: Writing file: [ C:\DummyGPO\{12345678-1234-1234-1234-123456789012}\bkupInfo.xml ]
    VERBOSE: Writing file: [ C:\DummyGPO\{12345678-1234-1234-1234-123456789012}\Backup.xml ]
    VERBOSE: Writing file: [ C:\DummyGPO\{12345678-1234-1234-1234-123456789012}\DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf ]

    PS C:\> Import-GPO -BackupGpoName 'DummyGPO' `
                       -Path 'C:\DummyGPO' `
                       -TargetName 'T1-Servers-URA' `
                       -CreateIfNeeded

Pre-populate the URA entries before importing. In this example, granting Log on as a batch job to a Tier 1 service-account group, and denying it to Tier 0 admins (SIDs are illustrative, replace with your own):

    PS C:\> $scaffoldPath = 'C:\Temp\T1URA'
    PS C:\> New-Item -Path $scaffoldPath -ItemType Directory -Force | Out-Null
    PS C:\> New-DummyComputerURAGPO -Path $scaffoldPath

    PS C:\> $gptTmpl = @'
    [Unicode]
    Unicode=yes
    [Version]
    signature="$CHICAGO$"
    Revision=1
    [Privilege Rights]
    SeBatchLogonRight=*S-1-5-21-1111111111-2222222222-3333333333-1101
    SeDenyBatchLogonRight=*S-1-5-21-1111111111-2222222222-3333333333-1001,*S-1-5-21-1111111111-2222222222-3333333333-1002
    '@

    PS C:\> $infPath = Join-Path $scaffoldPath 'DummyGPO\{12345678-1234-1234-1234-123456789012}\DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf'
    PS C:\> $gptTmpl | Out-File -FilePath $infPath -Encoding unicode -Force

    PS C:\> Import-GPO -BackupGpoName 'DummyGPO' `
                       -Path (Join-Path $scaffoldPath 'DummyGPO') `
                       -TargetName 'T1-Servers-URA' `
                       -CreateIfNeeded

Note: GptTmpl.inf must be written with Unicode (UTF-16 LE) encoding. Plain ASCII or UTF-8 will cause silent failures when Group Policy processes the file on the client.

Builtin Help

<#
.SYNOPSIS
Creates the files and directory structure needed to generate an User Rights Assignment group policy backup object.

.DESCRIPTION
Creates the files and directory structure needed to generate an User Rights Assignment group policy backup object.

.PARAMETER Path
The Path to where the structure should be created, defaults to your current location.

.EXAMPLE
PS C:\> New-DummyComputerURAGPO

.NOTES
FUNCTION: New-DummyComputerURAGPO
AUTHOR:   Tom Stryhn
GITHUB:   https://github.com/tomstryhn/

.INPUTS
[string]

.OUTPUTS

#>