RMS200280: How to Update GPOs With GPO-Editor-Groups

In the RayManageSoft installation directoy the UpdateGPOPermissions.exe file can be found. This file was introduced in RMS 10.6 and allows to grant a group the rights to change a GPO used to allocate packages.

 

How to Use the Executable:

First the command prompt must be started by a user with the required rights for the domain policies that are to be modified. After this, the UpdateGPOPermissions.exe file needs to be called with the following input parameter:

 

-d "DC=Domain,DC=NAME" >> C:\YourLogFile.log

 

UpdateGPOPermissions.exe will then modify the policy and add the missing GPO Editor Groups to it. All actions that are performed will be written into the log file. Having non-domain admin accounts in the GPO Editor Group will allow them to work with the policy.

 

How to Configure the GPO Editor Groups:

The so called GPO Editors have also been introduces with RayManageSoft 10.6. The GetGPOEditors stored procedure can always be called to get the current GPO Editor Groups. The resource rights for the groups can be configured by using the Assign rights wizard. As soon as the following two software allocations resources have been set, the group will be identified as a GPO Editor Group:

 

inline296650945.png

 

At the moment missing GPO Editor Groups can only be added. It is not possible to remove a group from the policy. Removing both resource rights and therefore removing a group from being a GPO Policy Group will not affect the existing policies.

Comments

Powered by Zendesk