Active Directory Computer Management: GPUpdate (from SpecOps)

SpecOps GPUpdate
http://www.specopssoft.com/products/specopsgpupdate/

If you maintain an Active Directory environment, then you probably work with Group Policies, manage your computers, and all sorts of other nifty management tasks, then you are probably hanging out in the Active Directory Users & Computers (ADUC) snap-in quite a bit throughout your day.

While this built-in utility from Microsoft (you can get it by running adminpak.msi from the a server i386 folder) is very good, and is quite powerful, there are some things that would greatly enhance the usefulness of the tool.

For example, when you right-click a computer object, you get the following options:

• Disable Account
• Enable Account
• Reset Account
• Manage
• Move...
• Delete

Impressive, no?

Well, no... not really!

Now, what if you have recently updated a group policy on your domain, and want to test out the policy changes on a computer? Or say you want to shut down a number of PCs in an OU?

With regards to the GPO updates, you could be waiting up to 90 minutes - the default replication time for a change to be seen by an affected PC. With GPUpdate, you can tell the PC to check for the updated GPO and download the settings immediately, all from the comfort of your ADUC console!

By default, there isn't any method in the ADUC for you to force the policy settings down to the computer in question (or shut computers down), unless you connect to it via different means and run gpupdate (command-line built in to Windows XP and above, you can download it for 2000, or use secedit) to force the changes to the PC - - domain controller replication timing notwithstanding.

And the assist by GPUPdate...

This is where SpecOps GPUpdate tool comes into play - think of it as an extension to the ADUC, and a much needed one at that!

From their website:

Specops Gpupdate makes your life as an administrator MUCH easier providing operations such as update of Group Policy Objects (gpupdate or secedit /refreshpolicy), remote restart, wake on lan (WOL) and remote shutdown.

All operations are available in the Active Directory Users and Computers interface and through Searches of Active Directory. Even entire OUs can be selected.

After performing a gpupdate or secedit /refreshpolicy, remote restart, wake on lan (WOL) or remote shutdown, you will get instant feedback in a graph.

A four-trick pony

GPUpdate does as the name suggests, it runs a GPUpdate process on a remote computer, but it also knows a few additional tricks!

• GPUpdate - Update Group Policy (gpupdate or secedit /refreshpolicy)
• Restart - Remote restart
• Shut Down - Remote shutdown
• Start - Start computers by Wake On Lan (WOL)

Also, a nice additional feature is a real-time graphical report showing the status of your shutdown requests, GPUpdate, etc.

OK, I'll admit, while this isn't a lot of additional options, it is enough to thank the good folks over at SpecOps software for making your job that much easier.

Installing is easy, but be aware that you have to run one additional step after the software is installed (read the installation documentation closely). This will enable the GPUpdate extensions in your AD environment (this is NOT a schema update), so you will need to enlist or notify the rest of your network admin team so they all know what is going on with their AD structure when GPUpdate is installed.

From the documentation PDF:

(Only once for each AD forest)

Open a command prompt and run the program SpecopsAducMenuExtensionInstaller.exe with the parameter /add . The program can be found the folder %CommonProgramFiles%\Specopssoft\Specops ADUC Extension.

The SpecopsAducMenuExtensionInstaller.exe registers the Specops Gpupdate Display Specifiers in AD so that ADUC know that it is being extended.

Display Specifiers are stored in the AD Configuration Container; this means that they only need to be registered once per AD forest and also that the user running the command needs to be a member of the Enterprise Admins. group, since only they can add Display Specifiers.

Important! Adding Display Specifiers is not a schema update and the process is 100% reversible, just run pecopsAducMenuExtensionInstaller.exe with the parameter /remove and the all the Specops Gpupdate Command Display Specifiers will be removed.

Download this and give it a try - it's a steal :)