Q: How does the logon script report Group Policies applied ?
A: The following code lists GPO names, but does not interpret the date/time field (REG_DWORD, variable $poltime) - Suggestions ??
;
; Registry locations for GPO applied to WinXP
; Current User
; enumerate gpextensions to capture SID. store GPO SID in log table. all variables global.
; *** 9/12/7 1231 gds need to convert Reg_Dword to KiXtart date format.
; hkcu\software\microsoft\windows nt\currentversion\winlogon\gpextensions\[sid]\LastpolicyTime (Reg_Dword)
$usersid="hkcu\software\microsoft\windows nt\currentversion\winlogon\gpextensions"
; enumerate SID - may bypass DisplayName='Local Group Policy'
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\0\DisplayName (String)
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\1\DisplayName (String)
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\2\DisplayName (String)
$userdname="hkcu\software\microsoft\windows\currentversion\group policy\history"
:loop1
$keyname=enumkey("$usersid",$index1)
if @error=0
$poltime=readvalue("$usersid\$keyname","LastPolicyTime")
$msg="User sid ($keyname)"
? "@DATE,@TIME,$msg"
:loop2
$sidname=enumkey("$userdname\$keyname",$index2)
if @ERROR=0
$dname=readvalue("$userdname\$keyname\$sidname","DisplayName")
$msg="User policy ($dname) was applied ($poltime)"
? "@DATE,@TIME,$msg"
goto loop2
endif
goto loop1
endif
; Local Machine
; enumerate gpextensions to capture SID
; hklm\software\microsoft\windows nt\currentversion\winlogon\gpextensions\[sid]\LastpolicyTime (Reg_Dword)
$computersid="hklm\software\microsoft\windows nt\currentversion\winlogon\gpextensions"
; enumerate SID - may bypass DisplayName='Local Group Policy'
; hklm\software\microsoft\windows\currentversion\group policy\history\[sid]\0\DisplayName (String)
; hklm\software\microsoft\windows\currentversion\group policy\history\[sid]\1\DisplayName (String)
; hklm\software\microsoft\windows\currentversion\group policy\history\[sid]\2\DisplayName (String)
$computerdname="hklm\software\microsoft\windows\currentversion\group policy\history"
[code repeats Current User]
