powershell / gpregistrypolicyparser

Registry Policy Parser Cmdlets

Future updates to this project will be implemented in the GPRegistryModule. Version 0.2 will continue to be available in this GitHub project and in the PowerShellGallery. This will ensure any projects taking a dependency on GPRegistryParser 0.2 will not be broken. Any updates to GPRegistryParser will be documented in the GPRegistryModule release notes, but none are expected.

These cmdlets will allow you to work with .POL files, which contain the registry keys enacted by Group Policy. The primary intent of these cmdlets is to enable enforcing security policy settings on Nano Server, but this method will also work on Windows Server 2016. These cmdlets are used internally by GPRegistryModule.

---

Parse-PolFile

Reads a .pol file containing group policy registry entries and returns an array of objects each containing a registry setting.

Syntax

Parse-PolFile [-Path <string>]  [<CommonParameters>]

Parameter Name	Description
Path	Specifies the path to the .pol file to be imported.

Example

C:\PS> $RegistrySettings = Parse-PolFile -Path "C:\Registry.pol"

---

Read-RegistryPolicies

Reads given registry entries and returns an array of registry settings.

Syntax

Read-RegistryPolicies [-Division <string>] [-Entries <string[]>]  [<CommonParameters>]

Parameter Name	Description
Division	Specifies the target registry division (LocalMachine, CurrentUser or Users)
Entries	Specifies the list of registry keys to be exported. The default value is set to 'Software\Policies'.

Example

C:\PS> $RegistrySettings = Read-RegistryPolicies -Entries @('Software\Policies\Microsoft\Windows', 'Software\Policies\Microsoft\WindowsFirewall')

C:\PS> $RegistrySettings = Read-RegistryPolicies -Divistion 'CurrentUser'

C:\PS> $RegistrySettings = Read-RegistryPolicies -Divistion 'LocalMachine' -Entries @('Software\Policies\Microsoft\Windows', 'Software\Policies\Microsoft\WindowsFirewall')

---

Create-RegistrySettingsEntry

Creates a .pol file entry byte array from a GPRegistryPolicy instance. This entry can be written in a .pol file later.

Syntax

$RegistrySettings = Create-RegistrySettingsEntry [-RegistryPolicy <GPRegistryPolicy[]>

Parameter Name	Description
RegistryPolicy	An instance of internal type 'GPRegistryPolicy'

Example

C:\PS> $Entry = Create-RegistrySettingsEntry -RegistryPolicy $GPRegistryPolicyInstance

---

Append-RegistryPolicies

Appends an array of registry policy entries to a file. The file must already have a valid header.

Syntax

Append-RegistryPolicies [-RegistryPolicies <GPRegistryPolicy[]>] [-Path <string>]

Parameter Name	Description
RegistryPolicies	An array of instance of internal type 'GPRegistryPolicy'
Path	Specifies the path to the .pol file to be imported.

Example

C:\PS> Append-RegistryPolicies -RegistryPolicies $RegistryPoliciesInput -Path "C:\Registry.pol"

---

gpregistrypolicyparser's Issues

Encoding issue with WindowsUpdate settings

The below keys appear to have some sort of encoding issue when returned from parse-polfile.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate:PauseFeatureUpdatesStartTime
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate:PauseQualityUpdatesStartTime

According to this these keys are a 1/0 value so it's odd that it's not coming through correctly.

PS7 Get-Content does not support -Encoding 'byte'

effects line:

GPRegistryPolicyParser/GPRegistryPolicyParser.psm1

Line 187 in 0318e64

[byte[]] $policyContentInBytes = Get-Content $Path -Raw -Encoding Byte

PowerShell Core does not have -Encoding Byte.

Line |
 187 |  … byte[]] $policyContentInBytes = Get-Content $Path -Raw -Encoding Byte
     |                                                                     ~~~~
     | Cannot process argument transformation on parameter 'Encoding'. 'Byte' is not a supported encoding name. For information on defining a custom encoding, see the documentation for the
     | Encoding.RegisterProvider method. (Parameter 'name')

I think this may be solved by using -AsByteStream