This PowerShell script helps monitor changes in Active Directory Group Policy Objects (GPOs). It compares the current day’s GPO export with the previous day’s data and generates a report that highlights new, deleted, renamed, and modified GPOs.

What the script does

The script exports all GPOs in the domain as XML reports and compares them against the previous snapshot. It then creates summary files for new GPOs, deleted GPOs, renamed GPOs, and changed settings. Finally, it sends the result by email and archives the collected data for the next run.

Required variables

At the beginning of the script, a few variables must be defined so the script can run correctly in your environment:

• ExportPath — base folder where all export and report data is stored.
• ADDomain — the Active Directory domain that should be analyzed.
• PathBaseFolder — the main working directory for the GPO change reporter.
• PathGPOArchiveFiles — folder used to store archived ZIP files.
• PathGPOCompare — folder used for the comparison data.
• PathGPOToday — folder for the current day’s GPO XML exports.
• PathGPOYesterday — folder for the previous day’s reference exports.
• PathGPOChangeHistory — folder used to store detailed change information.
• SMTP variables such as SmtpServer, SmtpFrom, and SmtpTo — required for email delivery of the report.

These values should be adapted to the target environment before the script is scheduled or executed manually. The script also relies on an existing previous-day export, which is created automatically during the first run.

How it works

First, the script reads all GPOs from the Active Directory domain and exports them to XML files. Then it compares the current export with the previous day’s export to detect changes. If differences are found, the script writes summary files and includes detailed change information in the email report.

GitHub download

Download the script here: GitHub repository