Added MayModify parameter for GPOs

ActiveDirectoryManagementFramework · Dec 8, 2023 · 95dd6f9 · 95dd6f9
1 parent 9443906
commit 95dd6f9
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 3 deletions.
diff --git a/DomainManagement/DomainManagement.psd1 b/DomainManagement/DomainManagement.psd1
@@ -3,7 +3,7 @@
 	RootModule         = 'DomainManagement.psm1'
 
 	# Version number of this module.
-	ModuleVersion      = '1.8.199'
+	ModuleVersion      = '1.8.201'
 
 	# ID used to uniquely identify this module
 	GUID               = '0a405382-ebc2-445b-8325-541535810193'

diff --git a/DomainManagement/changelog.md b/DomainManagement/changelog.md
@@ -1,8 +1,9 @@
 # Changelog
 
-## ???
+## 1.8.201 (2023-12-08)
 
 - Upd: Group Policy - will now detect group policies that have been created but not yet linked as created.
+- Upd: Group Policy - supports a setting (`-MayModify`) to ignore manual changes after deploying a GPO via ADMF.
 
 ## 1.8.199 (2023-09-27)
 

diff --git a/DomainManagement/functions/grouppolicies/Register-DMGroupPolicy.ps1 b/DomainManagement/functions/grouppolicies/Register-DMGroupPolicy.ps1
@@ -22,6 +22,9 @@
 	.PARAMETER ExportID
 		The tracking ID assigned to the GPO in order to detect its revision.
 
+	.PARAMETER MayModify
+		The group policy may be modified manually after deployment.
+
 	.PARAMETER WmiFilter
 		The WmiFilter to apply to the group policy object.
 
@@ -58,6 +61,10 @@
 		[string]
 		$ExportID,
 
+		[Parameter(ValueFromPipelineByPropertyName = $true)]
+		[switch]
+		$MayModify,
+
 		[Parameter(ValueFromPipelineByPropertyName = $true)]
 		[string]
 		$WmiFilter,
@@ -74,6 +81,7 @@
 			ID          = $ID
 			Path        = $Path
 			ExportID    = $ExportID
+			MayModify   = $MayModify
 			WmiFilter   = $WmiFilter
 			ContextName = $ContextName
 		}

diff --git a/DomainManagement/functions/grouppolicies/Test-DMGroupPolicy.ps1 b/DomainManagement/functions/grouppolicies/Test-DMGroupPolicy.ps1
@@ -113,7 +113,7 @@
 				'Healthy' {
 					$changes = [System.Collections.ArrayList]@()
 					$policyObject = $policyHash[$desiredPolicy.DisplayName]
-					if ($policyObject.Version -ne $policyObject.ADVersion) {
+					if (-not $desiredPolicy.MayModify -and $policyObject.Version -ne $policyObject.ADVersion) {
 						$change = New-Change -Property Modified -OldValue $policyObject.Version -NewValue $policyObject.ADVersion -Identity $desiredPolicy.DisplayName -Type AdmfVersion
 						$null = $changes.Add($change)
 					}