It is time to get rid of the Group Policy clutter! For anyone that has attempted a Group Policy cleanup, you will know how daunting that clutter can be. Today, we are going to tackle the first step in that process. We are going to quickly find all unlinked GPOs in our domain and delete any that aren’t needed!

These old GPOs have to go!

And just to make sure we don’t shoot ourselves in the foot, we are going to script a backup for every GPO that we delete. All of this with just a 6 line script!

Our Finding Unlinked GPOs with PowerShell Script

Get-GPO -All | Sort-Object displayname | Where-Object { If ( $_ | Get-GPOReport -ReportType XML | Select-String -NotMatch "<LinksTo>" )
{
Backup-GPO -name $_.DisplayName -path C:\Users\Public\GPOBackups
$_.DisplayName | Out-File .\UnLinkedGPOS.txt -Append
$_.Displayname | remove-gpo -Confirm
}}

This script relies on the Group Policy module. If you are running Windows 7 or above (and have the RSAT tools installed), you should have every cmdlet needed to run this script.

To start, we get a list of every GPO in the domain by using the Get-GPO cmdlet. We then take this list and generate a GPOReport for that GPO. By using Select-String, we can filter out GPOs without any links. Before deleting anything, we use the backup-gpo cmdlet to save a copy of our GPO to C:\Users\Public\GPOBackups.

For our records, we also use the Out-File cmdlet to generate a text file of any GPO that is unlinked. Finally, we use the remove-gpo cmdlet to delete the GPO. The -confirm switch prompts us to confirm each deletion. This gives us a chance to review the GPO before actually deleting it.

This wraps up a very short (but effective) post on Group Policy cleanup. If you have any questions, comments, or improvements – just drop a note in the comments section!