Find missing, bad, old ADMX files

[PrzemyslawKlys]

[Karl-WE]

Hi @PrzemyslawKlys how about having a Script to remove adm files from GPOs
Done so lately after a successful session with your awesome tool.

The removal is simple on FS

#Fetch Domain Name with either Resolve-DNSName or Get-ADDomain (latter has a module requirement) 
#how-to to handle multi Domain? 
[string]$DomainameFQDN = 

#Locate Policies folder in sysvol 
[string]$SysvolLocation = 

#Fetch and remove adm templates
[array]$ADMFiles = Get-Childitem *.adm -Files - Recurse | Remove-Item -force - confirm:$false

#ToDo Find a way to remove the from being linked in GPOs 
#as a workaround: log output of path where they were found 

$ADMFiles.Directory | Get-Unique

I hope this isn't a duplicate report or implemented, could not find it. Code snipped may contain errors. Written from the top of my mind how I solved it.

[Karl-WE]

Remote related #41

[Karl-WE]

I would be also thinking about how to find old (outdated ADMX and remove them from from the store) maybe the other project that's updating them could join forces to cleanup old ones.

[PrzemyslawKlys]

For ADM files:

• Get-GPOZaurrLegacyFiles
• Remove-GPOZaurrLegacyFiles
• Invoke-GPOZaurr -Type SysVolLegacyFiles

For ADMX cleanup - I started playing with it a while ago, but couldn't decide on the best approach. I have my own idea on ADMX but if someone wants to help - go ahead ;)

[PrzemyslawKlys]

Also for ADM files:

• Get-GPOZaurrFiles
• Invoke-GPOZaurr -Type GPOFiles - which does a more insight analysis and shows the user where some files may be misplaced

For ADMX:

• Get-GPOZaurrFilesPolicyDefinition - but that's just whether signature matches

[Karl-WE]

The legacy files thing is what I searched for. We went through the invoke-GPOzaurr twice but were not able to find the tab.

Could you help Przemek?

[PrzemyslawKlys]

Ye, just run Invoke-GPOZaurr -Type SysVolLegacyFiles. It's not enabled by default. You have to explicitly ask for it. Not all GPO reports are enabled by default. There are also others which are disabled for different reasons.

[tastyratz]

This is great for pulling old ADM files, but, I was thinking about it this week - some ADMX files are getting old and the dir gets bloated.

There could be some value in finding ADMX files in the policydefinitions folder that are no longer referenced by any group policies or only referenced by policies that are not in use for one reason or another right now which can safely be removed, if possible.

[PrzemyslawKlys]

I started working on ADMX analysis:

• Add new ADMX template handling functions #70

but it's mostly focusing on updating not up to date admx. Finding which GPO uses which ADMX would require some understanding how one is connected to other. If you have some logic.. feel free to share.

[tastyratz]

That might be duplicating efforts with Evergreen which already works quite well. There are also some admx templates like the ones from the Adobe pack that aren't actually dated correctly.

As far as logic goes,
it looks like ADMX files have target prefix policy name spaces in each of them and newer GPO's have the policy namespace referenced in the cmtx file. Maybe that's a start?
If an ADMX lists specific namespaces you could easily pull all namespace references in all gpo cmtx files to find which GPO's each ADMX file is referenced in.

You could probably also make sure admx permissions are good, the file can be parsed without error, things of that sort.