none
how to increase the GPO version

    Question

  • Hello guys,

    Tell me please is there any chance to increase the GPO version forcibly using Powershell? Or maybe some another tricky way to do that? I've tried by using the ADSI adapter to change the property version number of the GPO but I was told on Powershell forum that it's impossible currently to change directly from there.

    Thanks.

    Tuesday, August 09, 2016 11:53 AM

Answers

  • I have found out how to change AD version))

    $object = new-object system.directoryservices.directoryentry("LDAP://cn={GUID},cn=policies,cn=system,dc=contoso,dc=com"

    $object.versionnumber = any value you would like

    and finally!

    $object.setinfo()

    That's how GPC version can be changed.

    And as I know to change the GPT version I should raise the value in GPT.ini file.

    Friday, August 12, 2016 11:05 AM

All replies

  • Am 09.08.2016 um 13:53 schrieb AzatM:
    > Tell me please is there any chance to increase the GPO version forcibly
    > using Powershell?
     
    use Set-GPRegistryValue to write and delete a fake value.
     
    or write directly the version attribute of GPC and entry in gpt.ini in
    GPT (Sysvol)
     
    Mark
    --
    Mark Heitbrink - MVP Group Policy - Cloud and Datacenter Management
     
    Homepage:  http://www.gruppenrichtlinien.de - deutsch
     
    Tuesday, August 09, 2016 2:30 PM
  • Thanks for your reply. Could you tell me please how to write directly the attribute? I've written something like this using ADSI adapter:

    $object = [adsi]'LDAP://CN={Policy GUID},CN=Policies,CN=System,DC=contoso,DC=com'

    $object | gm

    There is a property I need "versionnumber". But how can I increase it by one as it's not the integer type. It's System.Directoryservices.propertyValueCollection

    Many thanks!

    Tuesday, August 09, 2016 2:55 PM
  • > $object = [adsi]'LDAP://CN={Policy
    > GUID},CN=Policies,CN=System,DC=contoso,DC=com'
     
    $object.VersionNumber should work.
     
    You need to write the versionnnumber property, and according to
    attribute editor in dsa.msc it is a simple integer. The same is true for
    the version= entry in gpt.ini.
     
    Both are 32 Bit integers where the low word denotes the computer version
    and the high word denotes the user version.
     
    Tuesday, August 09, 2016 4:39 PM
  • I have tried change that property via ADSI adapter ( and there powershell didn't allow me to chenge that property stating that it's not integer) as well as by using the get-gpo cmdlet and there is a property called computer.DSversion and computer.sysvol version but both are read only and can't be amended.
    Wednesday, August 10, 2016 6:48 AM
  • Do you have any ideas how can I change the version number then?
    Wednesday, August 10, 2016 6:49 AM
  • > Do you have any ideas how can I change the version number then?
     
    I do it from VBS, and it works fine... Don't know what's wrong in your
    code, maybe the ADSI interface is the culprit.
     
    Set oTargetGPO = GetObject( sTargetADSPath )
    oTargetGPO.PutEx ADS_PROPERTY_UPDATE, "versionNumber", array(
    iTargetVersion )
    oTargetGPO.SetInfo
     
    Then again, maybe you are using the wrong methods to write the property?
    As you can see, I cannot write directly, but have to use PutEx.
     
    Wednesday, August 10, 2016 11:09 AM
  • I'm trying in two ways:

    1.

    1) $object = get-gpo "test uac policy"

    2) $object.computer.dsversion++

        $object.computer.sysvolversion++

    in both cases I receive error saying that the property is read only.

    2.

    $object = [adsi]'LDAP://CN={Policy GUID},CN=Policies,CN=System,DC=contoso,DC=com'

    $object | gm

    There is a property I need "versionnumber". When I try to increase it by one by $object.versionnumber++ I'm getting the error "The ++ operator works only on numbers. This operand is a 'System.DirectoryServices.PropertyValueCollection'.

    What am I doing wrong?

    Thank you.

    Wednesday, August 10, 2016 11:41 AM
  • > When I try to increase it by one by $object.versionnumber++ I'm getting
    > the error "The ++ operator works only on numbers.
     
    Try
     
    $object.VersionNumber = ( $Object.VersionNumber + 1 ) or something like
    that :)
     
    I must admit I'm not very familiar with ADSI in Powershell.
     
    Wednesday, August 10, 2016 2:23 PM
  • Hi,

    It doesn't work too. If you do $object | gm then you could see that versionnumber property's definition looks like System.DirectoryServices.PropertyValueCollection versionnumber {get;set;}. It looks like that there is some method called "set" or something like that which will let you to change the versionnumber. But I still don't know how to do that. Googling haven't given any results as well.

    Also I found something similar to my case on one of forums. One guy writes there:

    $domain = New-Object System.DirectoryServices.DirectoryEntry("LDAP://test.com")

    i can READ:

    $domain.maxPwdAge

    I can SET:

    $domain.maxPwdAge = 10
    $domain.setinfo()

    I only missed 'setinfo()' method.....after that it finally works!

    • Edited by AzatM Thursday, August 11, 2016 9:14 AM
    Thursday, August 11, 2016 9:04 AM
  • I have found out how to change AD version))

    $object = new-object system.directoryservices.directoryentry("LDAP://cn={GUID},cn=policies,cn=system,dc=contoso,dc=com"

    $object.versionnumber = any value you would like

    and finally!

    $object.setinfo()

    That's how GPC version can be changed.

    And as I know to change the GPT version I should raise the value in GPT.ini file.

    Friday, August 12, 2016 11:05 AM
  • Hmmm... Another issue I've encountered. using the method below you can write any value but you cannot increase it by one as I need. The error comes up that the value is not integer type.
    Friday, August 12, 2016 11:21 AM