LGPO PowerShell module

A powershell module that applies registry keys using the Microsoft LGPO Toolkit.

Prerequisites

The module requires the LGPO.exe binary to be located in C:\ProgramData\LGPO\ The LGPO binaries from Microsoft Security Compliance Toolkit 1.0 will be needed. You can get it from here 'https://www.microsoft.com/en-us/download/details.aspx?id=55319'

Cmdlets

Get-LocalPolicySystemSettings - Retrieves all system policies
Set-LocalPolicySetting - Attempts to apply local system policy from a registry key
Update-LocalPolicySettings - Attempts to update local system policy from a file or data
Remove-LocalPolicySetting - Attempts to remove local system policy
Get-LocalPolicyUserSettings - Retrieves all user policies
Set-LocalPolicyUserSetting - Attempts to apply local user policy (Defaults to all users)
Remove-LocalPolicyUserSetting - Attempts to remove local user policy (Defaults to all users)
Clear-LocalPolicySetting - Erases all policies from system (Defaults to all polices)

Install

Option 1: Run the provided Install-LGPO.ps1
Option 2: Manually download LGPO bits from 'https://www.microsoft.com/en-us/download/details.aspx?id=55319', copy LGPO.exe to C:\ProgramData\LGPO, then install module using the following commands:
```
Install-Module LGPO -Force
Import-Module LGPO
```

Examples

# Gets current policies of system as object
Get-LocalPolicySystemSettings

# Gets current policies of users as object
Get-LocalPolicyUserSettings

# Sets policy name to system
Set-LocalPolicySetting -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell' -Name 'UseActionCenterExperience' -Type DWord -Value 0

# Remove system policy by name (sets to not configured)
Remove-LocalPolicySetting -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell' -Name 'UseActionCenterExperience'

# Remove system policy by name but ensure it can be set back (set to not configured but also enforces the key from being recreated)
Remove-LocalPolicySetting -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell' -Name 'UseActionCenterExperience' -Enforce

# Sets policy name to users
Set-LocalPolicyUserSetting -RegPath 'HCKU:\SOFTWARE\Policies\Microsoft\Windows\Explorer' -Name 'DisableNotificationCenter' -Type DWord -Value 1

# Remove policy name for users with verbose output
Remove-LocalPolicyUserSetting -RegPath 'HCKU:\SOFTWARE\Policies\Microsoft\Windows\Explorer' -Name 'DisableNotificationCenter' -Verbose

# Update (replace) policy from lpo generated txt file
Update-LocalPolicySettings -Policy Computer -LgpoFile C:\Lgpo.txt

# Filter out policies with * and rebuild
(Get-LocalPolicySystemSettings -Filter '$_.Name -ne "*"') | Update-LocalPolicySettings -Policy Computer

# Clear all policies with confirmation
Clear-LocalPolicySetting

# Clear computer policies without confirmation
Clear-LocalPolicySetting -Policy Computer -Confirm:$False

Validate

Run gpresult /H report.html to see the local policies that are set.

If keys set by LGPO do not exist as an Administrative template, they will be set in Extra Registry Settings
You can also use gpedit.msc to view settings set in Administrative template only

PowerShellCrack / LGPOPSmodule