Project

GPOZaurr

GPOZaurr helps inspect, report on, and remediate Group Policy environments with PowerShell.

Stars 1,256

Forks 120

Open issues 15

PowerShell Gallery downloads 421,558

Release v1.1.11

Language: PowerShell Updated: 2026-10-30

Command

Get-GPOZaurrBroken

Module: GPOZaurr

Detects broken or otherwise damaged Group Policies

Syntax

Get-GPOZaurrBroken
[[-ExcludeDomainControllers] <String[]>]
[[-ExcludeDomains] <String[]>]
[[-ExtendedForestInformation] <IDictionary>]
[[-Forest] <String>]
[[-IncludeDomainControllers] <String[]>]
[[-IncludeDomains] <String[]>]
[-SkipRODC]
[-VerifyDomainControllers]
[<CommonParameters>]

Parameter set: All Parameter Sets

Description

providing insight whether GPO exists in both AD and SYSVOL. It provides few statuses: - Permissions issue - means account couldn't read GPO due to permissions - ObjectClass issue - means that ObjectClass is of type Container, rather than expected groupPolicyContainer - Not available on SYSVOL - means SYSVOL data is missing, yet AD metadata is available - Not available in AD - means AD metadata is missing, yet SYSVOL data is available - Exists - means AD metadata and SYSVOL data are available

Examples

Example 1

Get-GPOZaurrBroken -Verbose | Format-Table

Parameters

-ExcludeDomainControllers String[] optionalposition: 2: Exclude specific domain controllers, by default there are no exclusions, as long as VerifyDomainControllers switch is enabled. Otherwise this parameter is ignored.
-ExcludeDomains String[] optionalposition: 1: Exclude domain from search, by default whole forest is scanned
-ExtendedForestInformation IDictionary optionalposition: 5: Ability to provide Forest Information from another command to speed up processing
-Forest String optionalposition: 0aliases: ForestName: Target different Forest, by default current forest is used
-IncludeDomainControllers String[] optionalposition: 4aliases: DomainControllers: Include only specific domain controllers, by default all domain controllers are included, as long as VerifyDomainControllers switch is enabled. Otherwise this parameter is ignored.
-IncludeDomains String[] optionalposition: 3aliases: Domain, Domains: Include only specific domains, by default whole forest is scanned
-SkipRODC SwitchParameter optional: Skip Read-Only Domain Controllers. By default all domain controllers are included.
-VerifyDomainControllers SwitchParameter optional: Forces cmdlet to check GPO Existance on Domain Controllers rather then per domain

Common Parameters

This command supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable.

For more information, see about_CommonParameters.