{"id":1668,"date":"2016-06-29T22:44:01","date_gmt":"2016-06-29T14:44:01","guid":{"rendered":"http:\/\/www.jhouseconsulting.com\/?p=1668"},"modified":"2021-07-07T19:33:39","modified_gmt":"2021-07-07T11:33:39","slug":"script-to-modify-the-defaultsecuritydescriptor-attribute-on-the-group-policy-container-schema-class-object","status":"publish","type":"post","link":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/2016\/06\/29\/script-to-modify-the-defaultsecuritydescriptor-attribute-on-the-group-policy-container-schema-class-object-1668","title":{"rendered":"Script to modify the defaultSecurityDescriptor attribute on the Group-Policy-Container schema class object"},"content":{"rendered":"

Last week I published an article about the changes in the behavior of Group Policy processing after the deployment of security update MS16-072 under KB3163622. It included a script to assist with the remediation of Group Policy permissions: Script to report on and remediate the Group Policy security change in MS16-072<\/a>.<\/p>\n

Of course that’s not where it ends. What about new Group Policies? Do you create a procedure that requires you to add “Domain Computers” with Read permission every time you create a new Group Policy Object (GPO)? No…of course not!<\/p>\n

What we need to do now is change the defaultSecurityDescriptor attribute on the Group-Policy-Container schema class object so that new GPOs are created with Domain Computers having Read permissions by default. Microsoft didn’t released an official script or method to do this, so here’s the next best thing.<\/p>\n

I will note that Darren Mar-Elia<\/a> created a blog post<\/a> to show you how to manually do this. Jeremy Moskowitz<\/a> also included these steps in his article<\/a>.<\/p>\n

I’m a big fan of scripting, and already had a script to this that I wrote back in 2011 using the Quest ActiveRoles Snapin Module. I wrote it for a delegated administrative model I implemented for a large University. I also recently found a great script from Peter Hinchley<\/a>: Set Default Permissions for New Group Policy Objects<\/a>. So I took both scripts and merged the ideas, basing a new script on Peter’s. The outcome was a very simple and repeatable way to modify the defaultSecurityDescriptor on the Group-Policy-Container schema class object without the need to go through the steps that Darren and Jeremy laid out.<\/p>\n

Before running the script you (or the account you’re running the script as) must be a member of the Schema Admins group.<\/p>\n

Run the script with no parameters (in report only mode) and it will report on the existing Security Descriptor, and what the new one will look like. So it’s basically showing you the projected outcome. The following screen shot shows that DC (the acronym for the well-known SID of Domain Computers) is added with Read permissions.<\/p>\n

\"Group-Policy-Container<\/a><\/p>\n

So how do we know that we’re applying Read permissions? Well I guess you need to understand a little bit about the Security Descriptor Definition Language (SDDL). Without going too deeply into SDDL in this article, the specific permission we are adding here is made up of the following 6 fields:<\/p>\n

ACE Type:<\/p>\n